The Utah Consumer Privacy Act contains more stringent applicability thresholds in comparison to other state laws, requiring controllers and processors to meet three prongs: 1. Do business in the state or targeting residents with products/services; 2. Have annual revenue of $25 million or more; and 3. Data collection, processing, or sale/revenue thresholds. The Act establishes the Department of Commerce Division of Consumer Protection, which will receive and investigate consumer complaints alleging violations of the UCPA.
