Utah House pauses privacy bill after lawmakers raise compliance, scope concerns

Representative (sponsor) presented first substitute House Bill 40 as a notice requirement that would require a commercial entity to disclose at the time of a transaction if it intends to sell a consumer’s nonpublic personal information for profit. The sponsor said the bill’s effective date would be in May and that retailers and business groups contacted in drafting had been neutral on the measure.

Lawmakers pressed the sponsor on specifics. Representative Dougal asked whether May provided adequate time for businesses to update forms and websites; the sponsor replied it would and that a simple one‑sentence web notice or a sign at a checkout could meet the requirement. Representative Morgan warned that the bill’s definition of “nonpublic personal information” includes Social Security numbers and urged caution to avoid unintended consequences.

Concern about economic impact surfaced repeatedly. Representative Dougal noted the fiscal note suggested some companies that sell personal information might see reduced sales and asked whether firms could be pushed out of the state; the sponsor said retailers had taken a neutral position in discussions but that the full impact was unknown. Representative Buffmeier and others asked whether notice alone would be sufficient to protect consumers, pointing to recurring unwanted solicitations despite prior opt‑out requests.

On enforcement and remedies, representatives asked who could bring suit under the bill’s private right of action; the sponsor answered that the consumer whose information was sold would have standing. Lawmakers also debated whether the bill merely notifies consumers or effectively permits the sale of personal data; critics said the title “notice of intent to sell nonpublic personal information” could be read as implying a right to sell.

After extended questioning and multiple members expressing that more drafting and clarification were needed, the House voted to “circle” the bill — a procedural move that removes HB 40 from the floor calendar so sponsors and stakeholders can address concerns. Supporters of circling said they wanted to resolve exemptions, clarify enforcement language and consider business compliance timelines before advancing the bill.

The bill’s sponsor told colleagues that HB 40 is intended as an initial, cautious step and that further measures on privacy could follow. With the motion to circle adopted, the House will not take final action on the measure during this floor session.