Privacy Law Library

Notice of Intent to Sell Nonpublic Personal Information Act

Utah NPI Notice Act

Other

Requires a commercial entity that may sell consumers' nonpublic personal information (such as SSN, creditworthiness, purchasing patterns, or preferences) to give a prescribed, conspicuous notice before collecting it. 2025 S.B. 150 limited coverage to entities with a staffed physical office in Utah and barred class actions.

Where

Utah

Citation

Utah Code Title 13, Chapter 37 (13-37-101 to 13-37-203)

Status

In force

Last amended

2025-05-07

Enforced by

None stated; private individual actions only

People can sue

Limited

Penalties

$500 for each failure to give notice plus court costs, in an individual action only (no class or representative actions), filed within one year of the transaction (13-37-203).

Applies to

• A commercial entity that maintains a physical office in Utah and in the ordinary course transacts business there with Utah consumers (13-37-102(2), (6), as narrowed by 2025 S.B. 150)
• That obtains nonpublic personal information in a consumer transaction and intends to disclose it to a third party for compensation that is the primary, direct consideration (13-37-201(1))
• Excludes entities subject to a federal law governing disclosure of nonpublic information to third parties, HIPAA covered entities, and disclosures tied to services or value provided (13-37-201(4)-(5))