Utah § 13-61-402 Enforcement powers of the attorney general.

Utah Statutes

§ 13-61-402 — Enforcement powers of the attorney general.

Utah § 13-61-402

Title 13Commerce and Trade

Ch. 13-61Utah Consumer Privacy Act

Part 13-61-4Enforcement

This text of Utah § 13-61-402 (Enforcement powers of the attorney general.) is published on Counsel Stack Legal Research, covering Utah primary law. Counsel Stack provides free access to over 12 million legal documents including statutes, case law, regulations, and constitutions.

Bluebook

Utah Code Ann. § 13-61-402 (2026).

Text

(1)The attorney general has the exclusive authority to enforce this chapter.

(2)Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of this chapter.

(3)(3)(a) At least 30 days before the day on which the attorney general initiates an enforcement action against a controller or processor, the attorney general shall provide the controller or processor:

(3)(a)(i) written notice identifying each provision of this chapter the attorney general alleges the controller or processor has violated or is violating; and

(3)(a)(ii) an explanation of the basis for each allegation.

(3)(b) The attorney general may not initiate an action if the controller or processor:

(3)(b)(i) cures the noticed violation within 30 days

Free access — add to your briefcase to read the full text and ask questions with AI

(1) The attorney general has the exclusive authority to enforce this chapter.
(2) Upon referral from the division, the attorney general may initiate an enforcement action against a controller or processor for a violation of this chapter.
(3) (3)(a) At least 30 days before the day on which the attorney general initiates an enforcement action against a controller or processor, the attorney general shall provide the controller or processor:
(3)(a)(i) written notice identifying each provision of this chapter the attorney general alleges the controller or processor has violated or is violating; and
(3)(a)(ii) an explanation of the basis for each allegation.
(3)(b) The attorney general may not initiate an action if the controller or processor:
(3)(b)(i) cures the noticed violation within 30 days after the day on which the controller or processor receives the written notice described in Subsection (3)(a); and
(3)(b)(ii) provides the attorney general an express written statement that:

(3)(b)(ii)(A) the violation has been cured; and
(3)(b)(ii)(B) no further violation of the cured violation will occur.
(3)(c) The attorney general may initiate an action against a controller or processor who:
(3)(c)(i) fails to cure a violation after receiving the notice described in Subsection (3)(a); or
(3)(c)(ii) after curing a noticed violation and providing a written statement in accordance with Subsection (3)(b), continues to violate this chapter.
(3)(d) In an action described in Subsection (3)(c), the attorney general may recover:
(3)(d)(i) actual damages to the consumer; and
(3)(d)(ii) for each violation described in Subsection (3)(c), an amount not to exceed $7,500.
(4) All money received from an action under this chapter shall be deposited into the Consumer Privacy Account established in Section 13-61-403.
(5) If more than one controller or processor are involved in the same processing in violation of this chapter, the liability for the violation shall be allocated among the controllers or processors according to the principles of comparative fault.