State Guide
Utah Privacy & Data Security Laws
Every statute below can apply to a business handling Utah residents' data, depending on your revenue, the number of Utah consumers you process, and what kind of data you collect. This is a general reference, not a determination for your specific business — run the full questionnaire to see which of these actually apply to you.
Comprehensive Privacy Law · 1
Requires BOTH $25M+ annual revenue AND (100,000+ Utah consumers, or 25,000+ with 50%+ of revenue from selling personal data).
Data Security & Breach Notification · 1
Requires notifying affected residents (and often the state AG/regulator) after a breach of unencrypted personal information such as SSNs, driver's license/state ID numbers, or financial account numbers. Applies regardless of company size whenever you hold covered personal information about a resident of this state.
Genetic Privacy · 1
Regulates direct-to-consumer genetic testing companies and/or genetic data generally — typically requiring express consent before collecting, using, or disclosing genetic data, and consent (or destruction) requirements for biological samples. AG civil enforcement only, up to $2,500/violation — no private right of action.
Children & Minors Online Safety · 1
Shifts age-verification duties to app stores and requires parental consent for minors' app downloads/purchases. Confirmed against the official Utah Code: § 13-76-201 now opens "Beginning May 6, 2027, an app store provider shall", and § 13-76-401 provides that beginning May 6, 2027 only a harmed minor (or that minor's parent) may sue, recovering the greater of actual damages or $1,000 per violation plus fees and costs — the 2026 amendment (reported as HB 498, effective Mar 18, 2026) removed state enforcement authority and pushed the substantive obligations out a year, leaving a private right of action as the only enforcement route. (Codification note: this is Title 13, Chapter 76. Sources citing §§ 13-75-101 et seq. are using the original 2025 numbering before it was renumbered; Chapter 71 is a different, unrelated act.)