Utah Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 13, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 13, 2026.

Current Landscape

The supplied Utah dataset reports zero tracked lawsuits, zero tracked demand letters, and zero tracked matters. It labels the informational risk level as “Lower” and identifies the Utah Interception of Communications Act (Utah Code § 77-23a-4). These are dataset-specific descriptions, not conclusions about all litigation or legal risk in Utah.

The dataset also lists digital technologies and practices, including online intake forms, advertising and analytics tools, social-media features, health-data sharing, biometric data, cookie banners, and Global Privacy Control (GPC). Their inclusion does not establish that they are subjects of Utah litigation or predict future claims.

No case summaries are supplied, so there are no case-specific allegations, holdings, standing decisions, or procedural rulings to report.

Current Litigation Activity

Current litigation component: 0/100.

Current Filing & Litigation Trends

No filing trend can be inferred from the supplied data. It reports zero tracked lawsuits, demand letters, and matters, but provides no historical comparison or information about tracking coverage.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Utah Interception of Communications Act — Utah Code § 77-23a-4 · private right of action

Regulatory Enforcement

Regulatory enforcement component: 18/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

• Utah Division of Consumer Protection action against Meta — Utah Department of Commerce, Division of Consumer Protection
  The release announces a multijurisdictional $12.2 billion settlement with Meta, subject to court approval, following Utah's consumer protection complaint.

Agency Guidance

Regulatory trend: active.

Global Privacy Control / Opt-Out Signals

Limited data

GPC / universal opt-out exposure component: limited data — this component is excluded from the overall risk guideline for this jurisdiction until researched (remaining components are reweighted accordingly).

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

The excerpt does not address Global Privacy Control or universal opt-out signals.

GPC evidence confidence: 95%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

No cases are currently tracked for this jurisdiction. This reflects our tracked source set, not an absence of litigation.

Technologies Appearing in Claims

• Online intake form
• Health-data sharing with third-party advertisers
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications
• Beauty filters
• Visible like counts
• Meta Pixel
• Meta Pixel Advanced Matching
• Facebook Conversions API
• Google Analytics
• Google DoubleClick
• websites/online interactions
• biometric data
• telephony/recordings
• video rental records
• Global Privacy Control (GPC)
• cookie_banner_requirements
• ad-tech

Historical Risk Guideline

What Businesses Should Review

As an operational review rather than a statement of legal requirements, businesses can compare their Utah-facing sites and apps with the listed technologies. Relevant items include intake forms, Meta Pixel and Advanced Matching, Facebook Conversions API, Google Analytics, Google DoubleClick, social-media integrations, and health-data or biometric features. Teams can document data flows, vendor involvement, cookie-banner choices, GPC handling, and consent or preference settings, and compare actual configurations with internal descriptions and user-facing notices. The supplied facts do not establish specific disclosure, consent, cookie-banner, or GPC obligations.

Data Quality

9 source(s), 7 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Utah Consumer Privacy Act: A New Law to Protect Online Data — Utah Attorney General · Tier A (Primary authority)
• Utah sues Hims & Hers for charging consumers without consent and sharing private health data — Utah Attorney General · Tier A (Primary authority)
• 26-340 - Aylo Freesites Ltd et al v. Utah Division of Consumer Protection et al - USCOURTS-utd-2_26-cv-00340 — GovInfo · Tier A (Primary authority)
• Utah Sues Hims & Hers — Utah Department of Commerce · Tier A (Primary authority)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Hims & Hers — Pending Enforcement Case and Complaints — Federal Trade Commission · Tier A (Primary authority)
• Order Denying Defendant Skullcandy, Inc.'s Motion to Dismiss Plaintiff's Complaint — U.S. District Court for the Southern District of California, via Justia · Tier A (Primary authority)
• Data Protection & Privacy 2026 - USA | Global Practice Guides — Chambers and Partners · Tier C (Professional analysis)
• The US State Privacy Law Tracker for 2026: Twenty Laws, One Compliance Baseline — Consenteo · Tier C (Professional analysis)

All State Pages