UCPA and browser fingerprinting

What UCPA says about fingerprinting

The Utah Consumer Privacy Act took effect on 31 December 2023 and is codified at Utah Code §13-61-101 through §13-61-404. UCPA is the Virginia cluster's outlier: it imported the basic shape of VCDPA, opt-out rights, sensitive-data opt-in, AG enforcement, no private right of action, and stripped out the harder-to-implement obligations. There is no Data Protection Assessment requirement, no Universal Opt-Out Mechanism, no profiling opt-out, and a revenue gate that excludes mid-size companies from the law entirely.

Section 13-61-101(24) defines personal data using the same linked-or-reasonably-linkable wording as the rest of the cluster, so a fingerprint hash used to recognise a returning Utah consumer falls inside the definition. But the operational obligations that follow that classification are materially lighter in Utah than in any other state in the cluster.

The drafting choice was deliberate. Utah's legislative debate in 2021 and 2022 emphasised business-friendliness as the design goal. The result is a privacy law that protects the most-affected consumer rights without imposing the operational compliance overhead of CCPA, CPA, or CTDPA.

When UCPA applies to you

Section 13-61-102 applies UCPA only to controllers that (a) conduct business in Utah or produce products or services targeted to Utah residents, (b) have annual revenue of $25 million or more, AND (c) either control or process the personal data of at least 100,000 Utah consumers in a calendar year, or control or process the personal data of at least 25,000 Utah consumers AND derive over 50% of gross revenue from the sale of personal data.

The compound test matters. UCPA is the only US state-privacy law with a revenue gate at the applicability layer. A controller with $20 million in revenue and two million Utah users is outside UCPA. A controller with $30 million in revenue and 80,000 Utah users is outside UCPA (consumer-count below 100,000 and sale-revenue below 50%).

Consumer is defined at §13-61-101(7) as an individual who is a Utah resident acting in an individual or household context. Employees and B2B contacts are excluded, matching the cluster.

The opt-out triggers and how they apply to fingerprinting

Section 13-61-201 grants Utah consumers four rights: access, deletion, portability, and opt-out. The opt-out applies only to targeted advertising and sale of personal data. UCPA does not include a profiling opt-out, the right that exists in every other Virginia-cluster state. A fingerprint used as one input to a profiling decision with legal effect is not opt-out-able under UCPA.

Sale of personal data under §13-61-101(31) requires monetary consideration only, matching Virginia and narrower than Colorado. Sharing fingerprint hashes for non-monetary value is unlikely to count as sale.

Targeted advertising at §13-61-101(34) carries the standard scope. Cross-site behavioural ads selected based on activity on non-affiliated sites and applications is in. First-party retargeting, frequency capping on your own site, and contextual advertising are out.

No Data Protection Assessment requirement

Every other Virginia-cluster state requires a documented Data Protection Assessment before engaging in targeted advertising, sale, sensitive-data processing, or covered profiling. UCPA does not. There is no §13-61-XXX equivalent of VCDPA's §59.1-580 or CPA's 4 CCR 904-3 Rule 8.

This is the largest operational difference between Utah and every other cluster state. A fingerprinting deployment may be launched into Utah without a documented DPA, which does not mean the controller has no obligations, but it does mean the AG cannot ground an enforcement action on a missing assessment.

The practical implication: do not skip the DPA exercise. The DPA you produced for VCDPA, CPA, or CTDPA covers Utah operationally. The absence of a UCPA-specific requirement is a forgiveness clause, not a license to avoid the work.

No Universal Opt-Out Mechanism recognition

Utah is also the only Virginia-cluster state that does not require Universal Opt-Out Mechanism support. There is no statutory requirement to recognise Global Privacy Control, and the Utah AG has not adopted a UOOM-recognition stance through guidance.

Practically, this means a controller that operates only in Utah can run an on-site opt-out preference centre without a GPC header check. A controller that operates in Utah AND Colorado, Connecticut, Oregon, Montana, Delaware, or New Hampshire still needs the GPC check for the other states, but Utah-only is the rare case where a non-UOOM deployment is statutorily compliant.

Dual enforcement and the cure window

UCPA enforcement runs through two offices. The Utah Division of Consumer Protection (part of the Department of Commerce) investigates consumer complaints and refers actionable matters to the Utah Attorney General, which prosecutes. Civil penalties cap at $7,500 per violation under §13-61-402.

The 30-day cure period at §13-61-402(2)(b) remains in effect with no scheduled sunset. The Division of Consumer Protection has signalled it will use the cure window generously for first-time documentation gaps and inadvertent processing errors. Repeat or wilful violations are treated more strictly, but the cure remains the default operational posture.

How Benny the Doorman fits into a UCPA-aware deployment

Three steps for a UCPA-aware deployment, all materially lighter than the equivalent CPA or CTDPA workflow. First, verify the $25 million revenue gate. If your average annual revenue over the prior three years is below $25 million, UCPA does not apply to you regardless of how many Utah consumers you process.

Second, implement an opt-out preference mechanism for targeted advertising and sale. UCPA does not require UOOM handling, so a clean on-site opt-out is sufficient, but if you operate in any other Virginia-cluster state with a UOOM requirement, you need the GPC check anyway and Utah is a free pass.

Third, treat the absence of a DPA requirement as a paperwork forgiveness clause, not a content-of-thinking forgiveness clause. Run the DPA exercise, Benny's documentation already provides the technical inputs, even though Utah's AG cannot ground enforcement on a missing one. The exercise itself surfaces operational issues before consumers do.