Does Utah's Privacy Law Require Businesses to Honor Universal Opt-Out Signals?

No. Utah's Consumer Privacy Act (UCPA) does not require businesses to recognize universal opt-out mechanisms — browser or device-level signals like Global Privacy Control that tell every site at once a consumer wants to opt out of targeted advertising and data sales. That makes Utah one of the more business-friendly comprehensive privacy laws on this specific point.

Utah's Opt-Out Rights Are Narrower to Begin With

The UCPA gives Utah residents the right to opt out of the sale of their personal data and of targeted advertising, but it doesn't build in the universal-signal requirement that several newer state laws added. Opt-out mechanisms under the UCPA come into play most directly around sensitive data processing, where businesses need affirmative consent rather than a simple opt-out link.

How That Differs From Colorado, Connecticut, and Oregon

Several comparable state privacy laws now require businesses to treat a detected universal opt-out signal as a valid, binding request — no separate action from the consumer needed on each individual site:

• Colorado's CPA requires honoring opt-out signals sent through user-selected mechanisms, such as browser settings or extensions.
• Connecticut's CTDPA has required controllers to recognize universal opt-out mechanisms as valid requests since January 1, 2025, per the Connecticut Attorney General's own guidance.
• Oregon's OCPA added the same requirement starting January 1, 2026, with the state's Department of Justice publicizing the tool that month.

Utah's law was drafted without that obligation, and nothing in subsequent amendments has added it — making the UCPA a notable exception within the growing list of comprehensive state privacy statutes.

What This Means in Practice for Marketers

A business serving ads to Utah residents doesn't need to build detection for Global Privacy Control or similar signals specifically to satisfy Utah law — though if that same business also serves consumers in Colorado, Connecticut, Oregon, or several other states, it likely needs that detection anyway for those other jurisdictions. In practice, few multi-state advertisers can afford to build Utah-only logic; most end up honoring universal signals everywhere once they've built the capability for stricter states.

Utah's Enforcement Is Comparatively Light-Touch

Where the UCPA does regulate, it does so gently. The Utah Attorney General is the sole enforcer — there's no private right of action — and the law gives businesses a 30-day cure period before any penalty attaches. Unlike several other states that let that cure window expire on a fixed date, Utah's cure period doesn't sunset; it stays available indefinitely for a first notice of violation. If a violation isn't cured in time, a court can impose actual damages plus a civil penalty of up to $7,500 per violation.

Bottom Line

Don't treat Utah as a reason to skip universal opt-out signal detection — build it for your stricter-state obligations, and Utah compliance comes along for free; just don't assume Utah law itself demands it.

Sources: Utah Consumer Privacy Act, Utah Code §§ 13-61-402, 13-61-305, as summarized by PrivacyLawMap's Utah state page (privacylawmap.com), Mofo's 2022 legislative analysis "And Then There Were Four? Utah on the Verge of Enacting Consumer Privacy Law" (mofo.com), and Kennedys Law's "Virginia Slim — A Cheat Sheet for the Utah Consumer Privacy Act" (kennedyslaw.com).