open-agreements 0.7.6 → 0.8.0

package/skills/legal-explainers/data-privacy-law-explainer/content/tennessee.md

@@ -0,0 +1,89 @@
+---
+jurisdiction: "Tennessee"
+slug: tennessee
+countryCode: US
+snapshotAsOf: "2026-06-19"
+lastReviewed: "2026-06-06"
+canonicalUrl: https://openagreements.org/practice-guides/privacy/us/tennessee
+license: CC BY 4.0
+stale: false
+---
+
+> [!IMPORTANT]
+> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
+> provided for general information. It is not legal advice, does not create an attorney-client
+> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
+> Laws change; verify against the canonical version before relying on it.
+>
+> **Canonical:** https://openagreements.org/practice-guides/privacy/us/tennessee · **Snapshot as of:** 2026-06-19 · License: CC BY 4.0 · © openagreements.org
+
+# Tennessee Consumer Privacy Law (TIPA)[^about]
+
+The Tennessee Information Protection Act gives Tennessee consumers rights over their personal information and imposes notice, contracting, and consent duties on large controllers — it stands out for an unusually high entry bar (over $25 million in revenue plus large consumer-volume tests) and a one-of-a-kind affirmative defense for businesses that maintain a written privacy program conforming to the NIST privacy framework, enforced exclusively by the Attorney General with no private right of action.
+
+
+## At a glance
+
+| Question | Tennessee |
+| --- | --- |
+| **Law coverage** | Comprehensive law |
+| **Summary** | If you exceed the $25 million revenue floor and meet Tennessee's large consumer-volume tests, TIPA requires a privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced by the Attorney General with a 60-day cure period and no consumer lawsuits, and uniquely offering an affirmative defense to businesses that maintain a written privacy program conforming to the NIST privacy framework. |
+| **Main law** | Tenn. Code Ann. §§ 47-18-3301 et seq. (Tennessee Information Protection Act) |
+| **Privacy policy required?** | Yes — a reasonably accessible, clear, and meaningful notice with statutorily fixed contents |
+| **Who does it cover?** | Persons doing business in Tennessee (or targeting residents) that exceed $25 million in revenue AND either process the information of 175,000+ consumers a year, or 25,000+ while deriving over 50% of gross revenue from selling personal information — a high entry bar; nonprofits, government, GLBA, HIPAA, and higher-education entities exempt |
+| **Can consumers sue?** | No |
+| **Privacy policy rule** | Policy contents fixed by law |
+| **Consent for sensitive data?** | Consent required first |
+| **Browser opt-out signals?** | Not required |
+| **Lawsuit detail** | No — enforcement is exclusively the Attorney General's |
+| **Who enforces it?** | Tennessee Attorney General and Reporter (exclusive) |
+
+## Does the Tennessee Information Protection Act apply to your business? {#does-tipa-apply}
+
+**Short answer.** Only if you clear a high entry bar. TIPA applies to persons doing business in Tennessee or targeting its residents that exceed $25 million in revenue and either process the information of at least 175,000 consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from selling personal information [^stat-3303-apply]. Many federally regulated entities and whole categories of organizations are carved out entirely [^stat-3311-exempt].
+
+What sets Tennessee apart from most state privacy laws is the dollar floor: a business under $25 million in revenue is outside the statute no matter how much data it handles. That makes TIPA reach far fewer companies than laws that key applicability to consumer volume alone. On top of the threshold, section 47-18-3311 exempts government bodies, financial institutions and GLBA-covered data, HIPAA covered entities and protected health information, nonprofits, institutions of higher education, and FCRA-, FERPA-, and DPPA-regulated data, among others. A consumer is a Tennessee resident acting only in a personal context, so employee and business-contact data is out of scope.
+
+## What must your Tennessee privacy policy contain? {#privacy-policy-contents}
+
+**Short answer.** A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal information processed, the purpose for processing, how consumers exercise their rights and appeal a decision, the categories of personal information sold to third parties, and the categories of those third parties [^stat-3305-notice].
+
+For a template privacy policy, section 47-18-3305(c) is the content checklist. TIPA also requires data minimization — collection limited to what is adequate, relevant, and reasonably necessary — and, where a controller sells personal information or processes it for targeted advertising, a clear and conspicuous disclosure of that processing and how to opt out. One Tennessee drafting note: items four and five of the notice are keyed to what the controller sells, not the broader idea of what it shares, so the notice should track the statute's wording rather than a looser paraphrase.
+
+## What must your contracts with processors say? {#vendor-contracts}
+
+**Short answer.** A contract between a controller and a processor must govern the processor's data processing on the controller's behalf — so a data processing agreement is a statutory requirement, not just a best practice [^stat-3306-contract].
+
+Section 47-18-3306(b) then specifies the required terms: processing instructions, the nature and purpose of processing, the type of data and duration, a duty of confidentiality, deletion or return of data at the controller's direction, the information needed to demonstrate compliance, cooperation with assessments, and a requirement to bind subcontractors by written contract to the same obligations. A compliant template data processing agreement tracks each of these. Separately, section 47-18-3312 makes any contract term that waives or limits a consumer's TIPA rights void as against public policy.
+
+## Do you need consent to process sensitive data? {#sensitive-data}
+
+**Short answer.** Yes. A controller may not process a consumer's sensitive data without obtaining consent, and for a known child it must instead process the data in accordance with the federal Children's Online Privacy Protection Act [^stat-3305-consent]. Sensitive data includes information revealing race or ethnicity, religious beliefs, a mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify a person; information collected from a known child; and precise geolocation data [^stat-3302-sensitive].
+
+This is the opt-in model, the opposite of a notice-and-opt-out approach. TIPA does not, however, require honoring a universal opt-out preference signal such as Global Privacy Control, so a Tennessee-only program can rely on its own opt-out mechanisms — though a multi-state template generally has to support universal signals to stay compliant elsewhere. A controller also needs consent before processing personal information for purposes beyond those reasonably necessary and compatible with the purposes it disclosed.
+
+## Can a consumer sue your business under TIPA? {#consumer-lawsuit}
+
+**Short answer.** No. The Attorney General and Reporter has exclusive authority to enforce TIPA, and the statute says a violation cannot be the basis for a private right of action, including a class action [^stat-3313-enforce]. Before suing, the Attorney General must give 60 days' written notice of the specific alleged violations and a chance to cure [^stat-3313-cure]. Uniquely, a business has an affirmative defense if it maintains a written privacy program that reasonably conforms to the NIST privacy framework [^stat-3314-nist].
+
+A controller that cures within the 60-day window and certifies the cure in writing avoids the action; an uncured violation exposes it to civil penalties of up to $7,500 per violation, with treble damages for willful or knowing violations. Tennessee's signature feature is the affirmative defense in section 47-18-3314: a controller or processor that creates, maintains, and complies with a written privacy program conforming to the NIST privacy framework (or a comparable framework) and providing consumers the substantive rights TIPA requires can raise that program as a defense. No other state pairs comprehensive privacy duties with a NIST-based safe harbor like this, which makes building a documented, framework-aligned program both a compliance step and a litigation shield.
+
+[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-06. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Tennessee. This article synthesizes Tennessee primary law and is not legal advice from a Tennessee-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.
+
+[^stat-3303-apply]: **Tenn. Code Ann. § 47-18-3303** — "This part applies to persons that conduct business in this state producing products or services that target residents of this state and that: - (1) Exceed twenty-five million dollars ($25,000,000) in revenue; and (2) - (A) Control or process personal information of at least twenty-five thousand (25,000) consumers and derive more than fifty percent (50%) of gross revenue from the sale of personal information; or - (B) During a calendar year, control or process personal information of at least one hundred seventy-five thousand (175,000) consumers." *Tenn. Code Ann. § 47-18-3303.* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3303/#:~:text=This%20part%20applies%20to%20persons,hundred%20seventy%2Dfive%20thousand%20(175%2C000)%20consumers.>
+
+[^stat-3311-exempt]: **Tenn. Code Ann. § 47-18-3311** — "This part does not apply to: - (1) A body, authority, board, bureau, commission, district, or agency of this state or of a political subdivision of this state; - (2) A financial institution, an affiliate of a financial institution, or data subject to Title V of the federal Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.);" *Tenn. Code Ann. § 47-18-3311(a).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3311/#:~:text=This%20part%20does%20not%20apply,U.S.C.%20%C2%A7%206801%20et%20seq.)%3B>
+
+[^stat-3305-notice]: **Tenn. Code Ann. § 47-18-3305** — "A controller shall provide a reasonably accessible, clear, and meaningful privacy notice that includes: - (1) The categories of personal information processed by the controller; - (2) The purpose for processing personal information; - (3) How consumers may exercise their consumer rights pursuant to § 47-18-3304, including how a consumer may appeal a controller's decision with regard to the consumer's request; - (4) The categories of personal information that the controller sells to third parties, if any; and - (5) The categories of third parties, if any, to whom the controller sells personal information." *Tenn. Code Ann. § 47-18-3305(c).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3305/#:~:text=A%20controller%20shall%20provide%20a,the%20controller%20sells%20personal%20information.>
+
+[^stat-3306-contract]: **Tenn. Code Ann. § 47-18-3306** — "A contract between a controller and a processor governs the processor's data processing procedures with respect to processing performed on behalf of the controller. The contract is binding and must clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing, and the rights and obligations of both parties." *Tenn. Code Ann. § 47-18-3306(b).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3306/#:~:text=A%20contract%20between%20a%20controller,and%20obligations%20of%20both%20parties.>
+
+[^stat-3305-consent]: **Tenn. Code Ann. § 47-18-3305** — "Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing the data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. § 6501 et seq.) and its implementing regulations." *Tenn. Code Ann. § 47-18-3305(a)(6).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3305/#:~:text=Not%20process%20sensitive%20data%20concerning,seq.)%20and%20its%20implementing%20regulations.>
+
+[^stat-3302-sensitive]: **Tenn. Code Ann. § 47-18-3302** — "‘Sensitive data’ means a category of personal information that includes: - (A) Personal information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; - (B) The processing of genetic or biometric data for the purpose of uniquely identifying a natural person; - (C) The personal information collected from a known child; or - (D) Precise geolocation data;" *Tenn. Code Ann. § 47-18-3302(26).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3302/#:~:text=%E2%80%9CSensitive%20data%E2%80%9D%20means%20a%20category,%2D%20(D)%20Precise%20geolocation%20data%3B>
+
+[^stat-3313-enforce]: **Tenn. Code Ann. § 47-18-3313** — "A violation of this part shall not serve as the basis for, or be subject to, a private right of action, including a class action lawsuit, under this part or other law." *Tenn. Code Ann. § 47-18-3313(e).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3313/#:~:text=A%20violation%20of%20this%20part,this%20part%20or%20other%20law.>
+
+[^stat-3313-cure]: **Tenn. Code Ann. § 47-18-3313** — "Prior to initiating an action under this part, the attorney general and reporter shall provide a controller or processor sixty-days' written notice identifying the specific provisions of this part the attorney general and reporter alleges have been or are being violated." *Tenn. Code Ann. § 47-18-3313(b).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3313/#:~:text=Prior%20to%20initiating%20an%20action,been%20or%20are%20being%20violated.>
+
+[^stat-3314-nist]: **Tenn. Code Ann. § 47-18-3314** — "A controller or processor has an affirmative defense to a cause of action for a violation of this part if the controller or processor creates, maintains, and complies with a written privacy policy that: (1) - (A) Reasonably conforms to the National Institute of Standards and Technology (NIST) privacy framework entitled ‘A Tool for Improving Privacy through Enterprise Risk Management Version 1.0.’ or other documented policies, standards, and procedures designed to safeguard consumer privacy;" *Tenn. Code Ann. § 47-18-3314(a).* <https://law.justia.com/codes/tennessee/title-47/chapter-18/part-33/section-47-18-3314/#:~:text=A%20controller%20or%20processor%20has,designed%20to%20safeguard%20consumer%20privacy%3B>

package/skills/legal-explainers/data-privacy-law-explainer/content/texas.md

@@ -0,0 +1,89 @@
+---
+jurisdiction: "Texas"
+slug: texas
+countryCode: US
+snapshotAsOf: "2026-06-19"
+lastReviewed: "2026-06-04"
+canonicalUrl: https://openagreements.org/practice-guides/privacy/us/texas
+license: CC BY 4.0
+stale: false
+---
+
+> [!IMPORTANT]
+> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
+> provided for general information. It is not legal advice, does not create an attorney-client
+> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
+> Laws change; verify against the canonical version before relying on it.
+>
+> **Canonical:** https://openagreements.org/practice-guides/privacy/us/texas · **Snapshot as of:** 2026-06-19 · License: CC BY 4.0 · © openagreements.org
+
+# Texas Consumer Privacy Law (TDPSA)[^about]
+
+The Texas Data Privacy and Security Act gives Texas consumers rights over their personal data and imposes notice, consent, contracting, and security duties on businesses that are not small businesses — with no revenue threshold, exclusive Attorney General enforcement, and no private right of action.
+
+
+## At a glance
+
+| Question | Texas |
+| --- | --- |
+| **Law coverage** | Comprehensive law |
+| **Summary** | If you do business in Texas and are not an SBA small business, the TDPSA requires a specific privacy notice, opt-in consent to process sensitive data, and processor contracts — enforced solely by the Attorney General, with no consumer lawsuits. |
+| **Main law** | Tex. Bus. & Com. Code ch. 541 (Texas Data Privacy and Security Act) |
+| **Privacy policy required?** | Yes — a reasonably accessible and clear notice with statutorily fixed contents |
+| **Who does it cover?** | Anyone who does business in Texas (or sells products/services to Texans), processes or sells personal data, and is not a small business as defined by the U.S. Small Business Administration — no revenue or data-volume threshold |
+| **Can consumers sue?** | No |
+| **Privacy policy rule** | Policy contents fixed by law |
+| **Consent for sensitive data?** | Consent required first |
+| **Browser opt-out signals?** | Not required |
+| **Lawsuit detail** | No — the statute bars any private right of action |
+| **Who enforces it?** | Texas Attorney General (exclusive) |
+
+## Does the Texas Data Privacy and Security Act apply to your business? {#does-tdpsa-apply}
+
+**Short answer.** Probably, if you handle Texans' personal data and are not a small business. Unlike California, Texas sets no revenue or data-volume threshold. The TDPSA applies to a person that does business in Texas or produces a product or service consumed by Texas residents, that processes or sells personal data, and that is not a small business as defined by the U.S. Small Business Administration [^stat-002-apply].
+
+This makes the small-business test the practical gatekeeper rather than a dollar figure. The SBA size standards are industry-specific (by revenue or headcount), so applicability turns on your NAICS classification, not a single statewide number. Two further limits matter: the statute reaches only a consumer acting in an individual or household context — not employees or business contacts — and it carries entity-level and data-level exemptions (state agencies, GLBA financial institutions, HIPAA-covered entities, nonprofits, higher education, and FCRA, DPPA, and FERPA data). One carve-out has a sting in its tail: even a small business that is otherwise exempt may not sell sensitive personal data without prior consumer consent.
+
+## What must your Texas privacy policy contain? {#privacy-policy-contents}
+
+**Short answer.** The TDPSA prescribes the contents of the privacy notice directly. A controller must provide a reasonably accessible and clear privacy notice that lists the categories of personal data processed (including any sensitive data), the purposes of processing, how consumers exercise and appeal their rights, the categories of personal data shared with third parties and the categories of those third parties, and a description of the methods for submitting requests [^stat-102-notice].
+
+For a template privacy policy, treat section 541.102 as a checklist: each of its six items must appear on the face of the policy, not be scattered through product UX. Two Texas-specific drafting points go beyond the generic list. First, if you sell personal data to third parties or process it for targeted advertising, you must clearly and conspicuously disclose that processing and how a consumer can opt out of it [^stat-103-optout]. The Texas text requires opt-out disclosure and request methods, but it does not add a Colorado- or Oregon-style duty to honor universal browser or global device opt-out signals. Second, if you sell sensitive or biometric personal data, the statute requires the policy to carry fixed, word-for-word notice sentences saying so — there is no room to paraphrase them.
+
+## What must your contracts with processors say? {#vendor-contracts}
+
+**Short answer.** Whenever a processor handles personal data on your behalf, the TDPSA requires a written contract that governs the processing — making a data processing agreement a statutory requirement, not a best practice [^stat-104-contract].
+
+Section 541.104 then specifies what that contract must contain: clear processing instructions, the nature and purpose of the processing, the types of data and duration, the parties' rights and obligations, and processor commitments to confidentiality, to delete or return data at the controller's direction, to make available the information needed to demonstrate compliance, to cooperate with assessments, and to bind any subcontractors by written contract to the same terms [^stat-104-terms]. A compliant template DPA tracks each of these elements.
+
+## Do you need consent to process sensitive data? {#sensitive-data-consent}
+
+**Short answer.** Yes. The TDPSA requires opt-in consent before processing a consumer's sensitive data, and for a known child it requires handling the data in accordance with the federal Children's Online Privacy Protection Act [^stat-101-consent]. Sensitive data includes data revealing race or ethnicity, religion, health diagnoses, sexuality, or immigration status; genetic or biometric data used to identify a person; data from a known child; and precise geolocation.
+
+Consent under the statute means a clear affirmative act reflecting a freely given, specific, informed, and unambiguous agreement — so pre-checked boxes and buried terms do not qualify. Selling sensitive data triggers an additional, non-negotiable disclosure: the controller must include the statute's exact sensitive-data and biometric sale-notice sentences in its notice [^stat-102-salenotice].
+
+## Can a consumer sue your business under the TDPSA? {#consumer-lawsuit}
+
+**Short answer.** No. The TDPSA expressly provides that it may not be construed as a basis for, or as being subject to, a private right of action — so consumers cannot sue under it [^stat-156-nopra]. Enforcement is exclusively the Texas Attorney General's, who may seek civil penalties of up to $7,500 per violation after a 30-day cure period [^stat-155-penalty].
+
+The practical consequence is that TDPSA exposure is regulatory, not class-action driven. The Attorney General must give written notice identifying the alleged violations and a 30-day window to cure before suing; a business that cures and certifies it has done so avoids the penalty. That posture is already live — the Attorney General has brought and announced TDPSA actions, including a suit over the covert sale of precise-geolocation driving data — so the cure period is a real off-ramp, not a reason to defer compliance.
+
+[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-04. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Texas. This article synthesizes Texas primary law and is not legal advice from a Texas-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.
+
+[^stat-002-apply]: **Tex. Bus. & Com. Code § 541.002** — "This chapter applies only to a person that: (1) conducts business in this state or produces a product or service consumed by residents of this state; (2) processes or engages in the sale of personal data; and (3) is not a small business as defined by the United States Small Business Administration, except to the extent that Section 541.107 applies to a person described by this subdivision." *Tex. Bus. & Com. Code § 541.002(a).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-102-notice]: **Tex. Bus. & Com. Code § 541.102** — "A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes: (1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller; (2) the purpose for processing personal data; (3) how consumers may exercise their consumer rights under Subchapter B, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request; (4) if applicable, the categories of personal data that the controller shares with third parties; (5) if applicable, the categories of third parties with whom the controller shares personal data; and (6) a description of the methods required under Section 541.055 through which consumers can submit requests to exercise their consumer rights under this chapter." *Tex. Bus. & Com. Code § 541.102(a).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-103-optout]: **Tex. Bus. & Com. Code § 541.103** — "If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose that process and the manner in which a consumer may exercise the right to opt out of that process." *Tex. Bus. & Com. Code § 541.103.* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-104-contract]: **Tex. Bus. & Com. Code § 541.104** — "A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller." *Tex. Bus. & Com. Code § 541.104(b).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-104-terms]: **Tex. Bus. & Com. Code § 541.104** — "The contract must include: (1) clear instructions for processing data; (2) the nature and purpose of processing; (3) the type of data subject to processing; (4) the duration of processing; (5) the rights and obligations of both parties; and (6) a requirement that the processor shall: (A) ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (B) at the controller's direction, delete or return all personal data to the controller as requested after the provision of the service is completed, unless retention of the personal data is required by law; (C) make available to the controller, on reasonable request, all information in the processor's possession necessary to demonstrate the processor's compliance with the requirements of this chapter; (D) allow, and cooperate with, reasonable assessments by the controller or the controller's designated assessor; and (E) engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the requirements of the processor with respect to the personal data." *Tex. Bus. & Com. Code § 541.104(b).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-101-consent]: **Tex. Bus. & Com. Code § 541.101** — "process the sensitive data of a consumer without obtaining the consumer's consent, or, in the case of processing the sensitive data of a known child, without processing that data in accordance with the Children's Online Privacy Protection Act of 1998 (15 U.S.C. Section 6501 et seq.)." *Tex. Bus. & Com. Code § 541.101(b)(4).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-102-salenotice]: **Tex. Bus. & Com. Code § 541.102(b)** — "If a controller engages in the sale of personal data that is sensitive data, the controller shall include the following notice" *Tex. Bus. & Com. Code § 541.102(b).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-156-nopra]: **Tex. Bus. & Com. Code § 541.156** — "This chapter may not be construed as providing a basis for, or being subject to, a private right of action for a violation of this chapter or any other law." *Tex. Bus. & Com. Code § 541.156.* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>
+
+[^stat-155-penalty]: **Tex. Bus. & Com. Code § 541.155** — "A person who violates this chapter following the cure period described by Section 541.154 or who breaches a written statement provided to the attorney general under that section is liable for a civil penalty in an amount not to exceed $7,500 for each violation." *Tex. Bus. & Com. Code § 541.155(a).* <https://statutes.capitol.texas.gov/Docs/BC/htm/BC.541.htm>

package/skills/legal-explainers/data-privacy-law-explainer/content/utah.md

@@ -0,0 +1,83 @@
+---
+jurisdiction: "Utah"
+slug: utah
+countryCode: US
+snapshotAsOf: "2026-06-19"
+lastReviewed: "2026-06-04"
+canonicalUrl: https://openagreements.org/practice-guides/privacy/us/utah
+license: CC BY 4.0
+stale: false
+---
+
+> [!IMPORTANT]
+> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
+> provided for general information. It is not legal advice, does not create an attorney-client
+> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
+> Laws change; verify against the canonical version before relying on it.
+>
+> **Canonical:** https://openagreements.org/practice-guides/privacy/us/utah · **Snapshot as of:** 2026-06-19 · License: CC BY 4.0 · © openagreements.org
+
+# Utah Consumer Privacy Law (UCPA)[^about]
+
+The Utah Consumer Privacy Act gives Utah consumers rights over their personal data and imposes notice, contracting, and sensitive-data duties on larger businesses — it has the narrowest applicability of the state privacy laws, treats sensitive data as notice-and-opt-out rather than opt-in, is enforced exclusively by the Attorney General after a 30-day cure, and provides no private right of action.
+
+
+## At a glance
+
+| Question | Utah |
+| --- | --- |
+| **Law coverage** | Comprehensive law |
+| **Summary** | The UCPA covers only larger businesses ($25M+ revenue plus a volume threshold). Covered controllers must post a privacy notice, give notice and an opt-out before processing sensitive data, sign processor contracts, and honor opt-outs — enforced by the Attorney General after a 30-day cure, with no consumer lawsuits. |
+| **Main law** | Utah Code §§ 13-61-101 et seq. (Utah Consumer Privacy Act) |
+| **Privacy policy required?** | Yes — a reasonably accessible and clear notice with statutorily fixed contents |
+| **Who does it cover?** | Controllers or processors doing business in Utah (or targeting Utahns) with $25,000,000+ annual revenue that also process the data of 100,000+ consumers a year, or 25,000+ while deriving 50%+ of revenue from selling data |
+| **Can consumers sue?** | No |
+| **Privacy policy rule** | Policy contents fixed by law |
+| **Consent for sensitive data?** | Opt-out right or limits instead |
+| **Browser opt-out signals?** | Not required |
+| **Lawsuit detail** | No — enforcement is exclusively the Attorney General's |
+| **Who enforces it?** | Utah Attorney General (after Division of Consumer Protection investigation) |
+
+## Does the Utah Consumer Privacy Act apply to your business? {#does-ucpa-apply}
+
+**Short answer.** Only if you are a larger business — Utah has the highest applicability bar of the state privacy laws. The UCPA reaches a controller or processor that does business in Utah or targets Utah residents, has annual revenue of $25,000,000 or more, and also meets a volume threshold: processing the data of 100,000 or more consumers a year, or 25,000 or more while deriving over 50% of revenue from selling personal data [^stat-102-apply].
+
+The combination is what makes Utah narrow: it requires a $25M revenue floor on top of a consumer-volume threshold, so a high-volume business under $25M is not covered (the inverse of Colorado, which has no revenue floor and even reaches nonprofits). As elsewhere, a consumer is a Utah resident acting in an individual or household context — not an employee or business contact — and the usual GLBA, HIPAA, and FCRA entity- and data-level exemptions apply.
+
+## What must your Utah privacy policy contain? {#privacy-policy-contents}
+
+**Short answer.** A covered controller must provide a reasonably accessible and clear privacy notice that lists the categories of personal data processed, the purposes of processing, how consumers exercise their rights, the categories of personal data shared with third parties, and the categories of those third parties [^stat-302-notice].
+
+For a template privacy policy, section 13-61-302 is the content checklist. Utah's list is close to the other states' but lighter in two ways worth noting: the UCPA does not require a separate appeal process the way Colorado and Texas do, and it imposes no data-protection-assessment obligation. A controller that sells personal data or processes it for targeted advertising must still clearly disclose that and how to opt out, but the UCPA does not require controllers to honor universal browser or global device opt-out signals.
+
+## What must your contracts with processors say? {#vendor-contracts}
+
+**Short answer.** Before a processor handles personal data on your behalf, the UCPA requires a contract — so a data processing agreement is a statutory prerequisite, not a best practice. The contract must set out the processing instructions, the nature and purpose of the processing, the data type and duration, and the parties' rights and obligations [^stat-301-contract].
+
+Section 13-61-301 adds the rest: the processor must keep personnel under a duty of confidentiality, and must bind any subcontractor by a written contract to the same obligations. A compliant template DPA carries each of these terms.
+
+## Do you need consent to process sensitive data? {#sensitive-data}
+
+**Short answer.** No — and this is where Utah is notably more permissive than other states. Rather than requiring opt-in consent, the UCPA lets a controller process an adult's sensitive data as long as it first presents the consumer with clear notice and an opportunity to opt out; for a known child, it must instead follow the federal Children's Online Privacy Protection Act [^stat-302-sensitive].
+
+This notice-and-opt-out model is the opposite of California, Colorado, and Texas, which all require affirmative opt-in consent before processing sensitive data. For a business operating across states, the practical consequence is that a Utah-only flow can rely on opt-out, but a multi-state template generally has to default to the stricter opt-in standard to stay compliant everywhere.
+
+## Can a consumer sue your business under the UCPA? {#consumer-lawsuit}
+
+**Short answer.** No. The Attorney General has exclusive authority to enforce the UCPA, so there is no private right of action for consumers [^stat-402-exclusive]. Enforcement runs through the Division of Consumer Protection (which takes complaints and investigates) and then the Attorney General, and a controller gets at least 30 days' written notice and a chance to cure before any action [^stat-402-cure].
+
+Unlike Colorado, Utah's cure period has not been repealed — it remains a built-in off-ramp. Penalties run up to $7,500 per violation. The compliance posture is still to build the notice, opt-out, and contracting controls up front, but a covered business that receives a notice has a genuine window to fix the issue before penalties attach.
+
+[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org). Last reviewed 2026-06-04. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Utah. This article synthesizes Utah primary law and is not legal advice from a Utah-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.
+
+[^stat-102-apply]: **Utah Code § 13-61-102** — "This chapter applies to any controller or processor who: (a) (i) conducts business in the state; or (ii) produces a product or service that is targeted to consumers who are residents of the state; (b) has annual revenue of $25,000,000 or more; and (c) satisfies one or more of the following thresholds:" *Utah Code § 13-61-102(1).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S102.html>
+
+[^stat-302-notice]: **Utah Code § 13-61-302** — "A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes: (i) the categories of personal data processed by the controller; (ii) the purposes for which the categories of personal data are processed;" *Utah Code § 13-61-302(1)(a).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S302.html>
+
+[^stat-301-contract]: **Utah Code § 13-61-301** — "Before a processor performs processing on behalf of a controller, the processor and controller shall enter into a contract that: (a) clearly sets forth instructions for processing personal data, the nature and purpose of the processing, the type of data subject to processing, the duration of the processing, and the parties' rights and obligations;" *Utah Code § 13-61-301(2).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S301.html>
+
+[^stat-302-sensitive]: **Utah Code § 13-61-302** — "process sensitive data collected from a consumer without: (a) first presenting the consumer with clear notice and an opportunity to opt out of the processing; or (b) in the case of the processing of personal data concerning a known child, processing the data in accordance with the federal Children's Online Privacy Protection Act" *Utah Code § 13-61-302(3).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S302.html>
+
+[^stat-402-exclusive]: **Utah Code § 13-61-402** — "The attorney general has the exclusive authority to enforce this chapter." *Utah Code § 13-61-402(1).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S402.html>
+
+[^stat-402-cure]: **Utah Code § 13-61-402** — "At least 30 days before the day on which the attorney general initiates an enforcement action against a controller or processor, the attorney general shall provide the controller or processor: (i) written notice identifying each provision of this chapter the attorney general alleges the controller or processor has violated or is violating;" *Utah Code § 13-61-402(3)(a).* <https://le.utah.gov/xcode/Title13/Chapter61/13-61-S402.html>