UCPA stands for Utah Consumer Protection Act. UCPA requires businesses to tell consumers what personal information they have collected, why they’re collecting it, and how long they plan on keeping it. The law also requires businesses to tell consumers if they’re sharing their personal information with third parties (e.g. advertisers).
The law was passed in February 2022. It allows consumers to request a copy of their data from companies that collect and store consumer data. If a company does not provide the requested information within 30 days, it must pay $100 per day for each day beyond the 30-day window until the consumer receives all requested documents or files.
Companies must also:
- make public disclosures about their privacy policies and practices;
- provide consumers with opt-out choices for the sharing of personal information;
- allow consumers to access their personal information from third parties;
- have reasonable security measures in place for data storage and protection;
- comply with requests for corrections or deletions of inaccurate or incomplete personal information; and
- notify consumers of significant breaches of security or unauthorized access to data.
