Lion Cipher Lab

Does the Utah Consumer Privacy Act apply to you? Scope UCPA and map its (deliberately narrow) consumer rights

• GRC / Compliance
• Intermediate
• ~45 min
• Free · no account required

Why it matters

Utah is the EASIEST of the US comprehensive state privacy laws to be OUT of, and the lightest to comply with when you are in - which makes it the single best regime for learning what 'business-friendly' actually means in statute text, and a trap for anyone who assumes every state works like the last one. Two facts do the teaching. First, UCPA is the only one of these laws with a genuine DOUBLE gate: a business must clear BOTH a $25,000,000 annual-revenue floor AND a consumer-volume prong, so a company that would be squarely in scope in revenue-agnostic Colorado can be entirely out in Utah,…

What you'll learn

• running the UCPA applicability test as a DOUBLE threshold - a $25,000,000 revenue floor AND a consumer-volume prong, both required
• explaining why Utah's revenue-AND-volume gate makes it stricter to trigger than Colorado's revenue-agnostic, counts-only test
• mapping the four consumer rights UCPA grants (access, delete, portability, opt out of targeted advertising and sale) onto an intake-to-response workflow with the 45-day clock
• naming precisely what UCPA OMITS versus Colorado and California - no right to correct, no profiling opt-out, no universal opt-out mechanism, no mandatory appeal
• getting sensitive data right - UCPA is OPT-OUT (notice and a chance to opt out), not the opt-IN consent Virginia and Colorado require
• getting enforcement right - Attorney General only via the Division of Consumer Protection, a durable 30-day cure period, and no private right of action
• recognizing that UCPA's 'sale' is monetary consideration only, narrower than Colorado's and California's
• seeing why Utah is the 'floor' and designing to the STRICTEST state you touch rather than shipping a separate, weaker Utah programme

Steps in this lab

1. The vocabulary, the citation, and who enforces this
2. Set up the worksheet - the memo and the rights matrix have homes now
3. The applicability test - a DOUBLE gate: revenue floor AND a volume prong
4. Scope and definitions - the B2B/HR carve-out, sensitive data (opt-OUT), and exemptions
5. The consumer rights and the matrix - four rights, the 45-day clock, and what is MISSING
6. Utah vs the stricter states - why UCPA is the FLOOR and you design UP from it (aside)

Open the full interactive lab →