UCPA: the Utah law explained for people with ads

Show clearly how to opt out

Anyone who sells data or does targeted advertising must show clearly and visibly how the visitor opts out. The law does not define the link text.

Publish a clear privacy notice

The notice lists the categories of data, the purposes, how to exercise rights, the data shared with third parties and the types of third parties.

Give notice before using sensitive data

Before processing sensitive data, the site gives a clear notice and the chance to opt out. For a known child, the COPPA law applies.

Respond within 45 days

Requests get a response within 45 days. If it needs another 45, the site notifies the visitor and says how much longer it will take.

Honor the correction request

Since July 1, 2026, the visitor can also ask for incorrect data to be corrected.

Use the US National section with Google

Google does not accept the Utah section of the GPP string. For Utah, the CMP must send US National, or the site turns on RDP directly in the tag.

// GPT: liga o processamento restrito de dados (RDP)
// para quem recusou a venda ou a publicidade direcionada
googletag.cmd.push(function () {
  googletag.pubads().setPrivacySettings({
    restrictDataProcessing: true
  });
});

Fix quickly if notified

The attorney general notifies in writing and gives 30 days to fix it. If the failure continues, the fine reaches US$ 7,500 per violation.