Does the Utah Consumer Privacy Act apply to your business?

Utah's law is the friendliest to business of the state privacy statutes, and the reason is a single number. Where Virginia and Colorado ask only how many people you reach, Utah first asks how much money you make. That revenue floor keeps most small and mid-size companies out of the law entirely.

Who the UCPA covers

The Utah Consumer Privacy Act applies to a controller or processor that conducts business in Utah or targets its products or services to Utah residents, has annual revenue of $25 million or more, and meets a data threshold. All three parts must be true at once. The revenue floor is what sets Utah apart: a company under $25 million in annual revenue is outside the law no matter how many Utah consumers it serves. That is a very different starting point from most other states.

What are the thresholds?

Once you clear the $25 million revenue floor, one of two data thresholds must also apply in a calendar year: controlling or processing the personal data of 100,000 or more consumers, or deriving over 50 percent of gross revenue from the sale of personal data while controlling or processing the data of 25,000 or more consumers. Because a revenue minimum and a data threshold both have to be met, Utah covers noticeably fewer businesses than Virginia or Colorado, which impose no revenue floor at all.

Who is exempt?

Utah exempts government entities, tribes, nonprofit organizations, institutions of higher education, HIPAA covered entities and business associates, GLBA financial institutions, and air carriers. As in other states, specific data is also carved out where federal law already governs it, including protected health information under HIPAA, consumer-report data under the Fair Credit Reporting Act, and education records under FERPA. Data processed purely in an employment or B2B context does not count toward the consumer thresholds.

How Utah compares

The $25 million revenue floor makes Utah the narrowest of the comprehensive state laws. A mid-size SaaS company can easily be exempt in Utah while covered under the Virginia VCDPA or the Colorado Privacy Act, which count consumers with no revenue minimum, and covered under the Texas TDPSA, which uses a small-business test instead of numbers. The US state privacy laws hub shows why one state's answer rarely settles the next.

Next step

Utah usually comes down to two figures: your annual revenue and your count of Utah consumers. The free 2-minute Obligation Scan checks both against the UCPA thresholds and tells you whether the law reaches you, then maps the notices, opt-outs, and consumer rights you would owe if it does, so you are not guessing at a revenue-plus-volume test.