Türkçe
English
Submit your website to identify cookies, pixels, tags and third-party technologies that may process personal data.
Home / USA Laws UCPA
Get Started
Get your website ready for UCPA compliance
Identify cookies and tracking technologies, support privacy choices and keep website controls aligned with the Utah Consumer Privacy Act. Okito brings scans, opt-out settings and preference records together in one dashboard.
Powering we provide the latest solutions for website privacy compliance
Practical tools for UCPA compliance
See what your website collects
Scan your website for cookies, pixels, tags and third-party scripts that may collect or disclose personal data. Okito organises detected technologies by purpose, provider, category and duration, giving your team a clearer view of its website data practices.
Turn privacy choices into working controls
Configure opt-out experiences around targeted advertising, personal data sales and sensitive data practices. Connect visitor choices with relevant cookies and scripts so the controls shown on your website reflect its configured technologies.
Manage privacy settings across your websites
Review scan results, privacy configurations and visitor preference records through a central dashboard. Okito helps businesses and multi-site teams maintain consistent controls while adapting each website to its own vendors and data practices.
Key Requirements for USA Laws UCPA Compliance
Build an accurate website data inventory
A reliable data inventory supports UCPA compliance by showing which technologies collect or share personal data through your website. Online identifiers and browsing activity may qualify as personal data when they are linked or reasonably linkable to an identifiable individual.
Scan for cookies, pixels, tags, trackers and third-party scripts.
Classify detected technologies by purpose, provider and duration.
Review your inventory when plugins, vendors or advertising tools change.
Okito organises detected technologies in a central dashboard, making it easier to keep your consent management settings and UCPA privacy policy aligned with your current website setup.
Configure UCPA consent management and opt-outs
UCPA consent management does not mean obtaining consent for every cookie. The law gives Utah consumers the right to opt out of targeted advertising and the sale of personal data, while sensitive data requires clear notice and an opportunity to opt out before processing.
Provide clear opt-out controls for applicable sales and targeted advertising.
Connect visitor choices with the relevant configured cookies and scripts.
Review each third-party technology according to how personal data is used.
Under the UCPA, a sale generally means exchanging personal data with a third party for monetary consideration. Okito helps you configure website-level privacy choices without treating every third-party disclosure or cookie as a sale.
Keep your UCPA privacy policy up to date
A UCPA privacy policy should explain what personal data is processed, why it is used and how consumers can exercise their rights.
Disclose data categories, processing purposes and categories of third parties.
Explain consumer requests and applicable opt-out rights.
Identify personal data sales and targeted advertising where relevant.
Sensitive data includes precise geolocation, certain health information and qualifying biometric data. Known children’s data must be handled under COPPA.
Okito organises detected technologies and privacy choices to support accurate disclosures without replacing legal review.
UCPA compliance checklist for websites
Use this checklist to align your website and consent management controls with UCPA requirements.
Confirm annual revenue of at least $25 million and either the 100,000-consumer threshold or the 25,000-consumer threshold with more than 50% of revenue from personal data sales.
Review exemptions and identify technologies that process personal data.
Maintain a UCPA privacy policy covering purposes, rights and third-party sharing.
Provide access, correction, deletion and portability procedures.
Configure and test applicable opt-outs for sales, targeted advertising and sensitive data.
Okito brings website scans, privacy controls and preference records together to support your UCPA compliance programme.
Simplify Your USA Laws UCPA Compliance Today
What rights do Utah consumers have?
Subject to applicable exceptions, Utah consumers may:
Confirm whether a controller processes their personal data and access that data.
Correct inaccuracies in their personal data.
Delete personal data they provided to the controller.
Obtain eligible data they previously provided in a portable format.
Opt out of targeted advertising and the sale of personal data.
Controllers generally have 45 days to respond to an authenticated request. The period may be extended once by another 45 days when reasonably necessary, provided the consumer is informed within the initial period.
FAQ
Frequently Asked Questions UCPA Compliance
The Utah Consumer Privacy Act (UCPA) is Utah’s comprehensive consumer privacy law. It took effect on December 31, 2023 and establishes requirements for covered controllers that process Utah residents’ personal data.
The law covers privacy notices, data security, consumer requests, sensitive data, targeted advertising and personal data sales. Since July 1, 2026, Utah consumers also have the right to correct inaccurate personal data.
Personal data is information linked or reasonably linkable to an identified or identifiable individual. Depending on how they are used, this may include names, contact details, IP addresses, device identifiers, cookie IDs and browsing activity.
The definition excludes aggregated data, deidentified data and publicly available information that meets the UCPA’s conditions.
A sale generally occurs when a controller exchanges personal data with a third party for monetary consideration. This definition is narrower than laws that also cover exchanges for other valuable benefits.
Certain disclosures are excluded, including transfers to processors or affiliates, consumer-directed disclosures and transfers made during a merger or acquisition.
The UCPA does not expressly require every website to display a cookie consent banner or obtain consent for every cookie. Covered controllers must provide an opt-out method when website technologies are used for targeted advertising or the sale of personal data.
A consent management platform can connect these choices with relevant cookies and scripts. Additional banner or consent requirements may arise under other applicable privacy laws.
Before processing sensitive data, a covered controller must provide clear notice and an opportunity to opt out. Sensitive data includes:
Racial or ethnic origin, religious beliefs and sexual orientation.
Citizenship or immigration status.
Certain health and medical information.
Precise geolocation and qualifying genetic or biometric data.
Personal data concerning a known child must be processed in accordance with the federal Children’s Online Privacy Protection Act (COPPA).
The UCPA establishes the following response periods:
Initial response: Within 45 days of receiving an authenticated request.
Conditional extension: Up to 45 additional days when reasonably necessary because of the complexity or number of requests.
The consumer must be informed of the extension and its reason within the initial 45-day period.
The Utah Attorney General has exclusive authority to enforce the UCPA. Before bringing an enforcement action, the Attorney General must generally provide written notice and a 30-day opportunity to cure the alleged violation.
An uncured or continuing violation may result in actual damages and a civil penalty of up to $7,500 per violation. The UCPA does not create a private right of action.
For official information about the Utah Consumer Privacy Act, visit: