Learn about the key requirements and best practices for cookie consent under the Utah Consumer Privacy Act (UCPA). Understand what constitutes consent, when it is necessary, and other important UCPA obligations. Find out if your business needs to comply with the UCPA and discover how it compares to other state privacy laws. Get practical tips for UCPA cookie consent compliance and explore the penalties for non-compliance. Stay informed and ensure your business follows the UCPA guidelines effectively.
Utah stands among the select number of US states that have enacted a consumer privacy law, becoming the fourth state to legislate the protection of consumers' personal information.
Utah Governor Spencer Cox signed the law on March 24, 2022, making Utah the fourth state with consumer privacy legislation in place. It will come into effect on December 31, 2023.
Explore more privacy compliance insights and best practices
The Utah Consumer Privacy Act (UCPA) aligns with the precedent established by California, Virginia, and Colorado, all of which have enacted data privacy laws in recent years. Connecticut joined this group shortly after Utah, and Iowa, Indiana, and Tennessee joined a few months later.
For businesses operating in Utah or online businesses targeting Utah residents, it's crucial to become familiar with this law as it imposes obligations on your operations. Understanding and complying with the UCPA requirements is not difficult. In fact, the UCPA presents straightforward requirements similar to those found in other state privacy laws. However, it is important to first learn about these requirements.
This article focuses on the cookie consent requirements arising from the UCPA. It will help you understand:
Your business needs to comply with the Utah Consumer Privacy Act (UCPA) if it meets the following criteria:
However, certain entities are exempt from the UCPA, including:
It's important to note that the UCPA applies only to data of identifiable individuals, and de-identified data, publicly available data, and aggregated data are excluded from the scope of the law.
UCPA cookie consent refers to "an affirmative act by a consumer that unambiguously indicates the consumer's voluntary and informed agreement to allow a person to process personal data related to the consumer."
For valid consent, the user must:
In the context of online businesses, this means that the business must:
Although the UCPA does not specifically address the use of web cookies and tracking technologies, it regulates the processing of personal data regardless of the technology used.
Considering how cookies function, it raises questions about whether the UCPA imposes any requirements specifically for the use of cookies.
However, it's important to note that obtaining consumer consent is necessary for the processing of children's data.
When collecting data from children, you must obtain consent using the methods outlined in the Children's Online Privacy Protection Act (COPPA), which include:
These methods ensure compliance with COPPA when obtaining consent for the processing of children's data.
The UCPA allows the processing of sensitive data if the business provides the consumer with a clear privacy notice and an opportunity to opt out of the processing. Opt-in is not required.
Some other laws, such as the Virginia Consumer Data Protection Act and the Connecticut Data Protection Act, require an explicit opt-in for the processing of sensitive data. The Utah privacy legislation does not follow that precedent.
The UCPA relies on the opt-out principle, which means that businesses are free to process data as long as the consumer does not oppose the processing through the use of opt-out mechanisms.
Sensitive data includes:
Having in mind that you don't need to obtain cookie consent under the UCPA, the other consent-related requirements are rather limited.
Only the processing of children's personal information would create additional duties, such as having to prove that you have obtained parental consent.
However, you also have to comply with the following data privacy requirements:
The Utah Consumer Privacy Act (UCPA) is managed by the Utah Attorney General. This office can investigate UCPA-related issues and impose fines on businesses that violate the rules.
The Attorney General has the authority to:
Before issuing any fines, the Attorney General allows businesses 30 days to rectify the issue. If the business resolves the problem within this timeframe, no fine will be imposed. However, if the issue remains unresolved, the business will be fined.
The Division of Consumer Protection can also investigate consumer complaints, but it does not have the power to take enforcement action.
Unlike California's law, the UCPA does not grant consumers a private right of action to pursue legal action on their own. Instead, they must rely on the Attorney General to defend their privacy rights.
The UCPA is considered the least demanding consumer data privacy legislation in the United States.
Compared to other similar laws such as the California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Colorado Privacy Act (CPA), Virginia Consumer Data Protection Act (VCDPA), and the Connecticut Data Protection Act (CTDPA), the UCPA offers less stringent protections for consumer personal data.
These other laws may include provisions such as allowing a private right of action, requiring explicit consent for sensitive data processing, and mandating data privacy assessments to mitigate risks.
Furthermore, it's worth noting that the UCPA falls significantly short of the requirements set forth in the EU's General Data Protection Regulation (GDPR).
Ensure that you obtain parental consent if you collect data on a known child.
In all other cases, make sure to provide consumers with a privacy notice, a privacy policy, and, if applicable, mechanisms to opt out of the processing of sensitive data, processing for targeted advertising, and the sale of the consumer's personal data, unless exemptions apply.
Consider using a consent management platform to facilitate the handling of privacy notices, opt-out mechanisms, and exemptions.
