As used in this chapter:

1. (1) "Affiliate" means a person that controls, is controlled by, or is under common control with:

   1. (a) a commercial entity; and

   2. (b)

      1. (i) directly; or
      2. (ii) indirectly through one or more intermediaries.

2. (2)

   1. (a) Subject to Subsection (2)(b), "commercial entity" means a person that:

      1. (i) maintains a physical office in the state; and
      2. (ii) in the ordinary course transacts business at the physical office with consumers located in the state.

   2. (b) "Commercial entity" does not include:

      1. (i) a governmental entity; or
      2. (ii) an entity providing services on behalf of a governmental entity.
3. (3) "Compensation" means anything of economic value that is paid or transferred to a commercial entity for or in direct consideration of the disclosure of nonpublic personal information.

4. (4)

   1. (a) "Consumer transaction" means:

      1. (i) a sale, lease, assignment, award by chance, or other written or oral transfer or disposition:

         1. (A) that is initiated or completed in this state; and

         2. (B) of:

            1. (I) goods;
            2. (II) services; or
            3. (III) other tangible or intangible property, except securities and insurance or services related thereto; or

      2. (ii) a transaction:

         1. (A) that is initiated or completed in this state; and
         2. (B) that constitutes credit offered or extended by a commercial entity to a person primarily for personal, family, or household purposes.

   2. (b) "Consumer transaction" includes:

      1. (i) the use of nonpublic personal information in relation to a transaction with a person if the transaction is for primarily personal, family, or household purposes; and

      2. (ii) with respect to any transaction described in Subsection (4)(a):

         1. (A) an offer or solicitation;
         2. (B) an agreement;
         3. (C) the performance of an agreement; or
         4. (D) a charitable solicitation as defined in Section 13-11-3.
   3. (c) "Consumer transaction" does not include a transaction related to real property.

5. (5)

   1. (a) "Nonpublic personal information" means information that:

      1. (i) is not public information; and
      2. (ii) either alone or in conjunction with public information, identifies a person in distinction from other persons.

   2. (b) "Nonpublic personal information" includes:

      1. (i) a person's Social Security number;

      2. (ii) information used to determine a person's credit worthiness including a person's:

         1. (A) income; or
         2. (B) employment history;
      3. (iii) the purchasing patterns of a person; or
      4. (iv) the personal preferences of a person.

6. (6)

   1. (a) "Physical office" means a location:

      1. (i) accessible to the public during normal business hours;
      2. (ii) staffed by one or more individuals who conduct business on behalf of the commercial entity; and
      3. (iii) used for the primary purpose of transacting business with consumers in the state.
   2. (b) "Physical office" does not include a post office box, mailing address, registered agent, or virtual office that a person solely relies on for business correspondence.

7. (7) "Public information" means a person's:

   1. (a) name;
   2. (b) telephone number; or
   3. (c) street address.

8. (8)

   1. (a) Subject to Subsection (8)(b), "third party" means a person other than the commercial entity that obtains nonpublic personal information.
   2. (b) "Third party" does not include an affiliate or agent of the commercial entity that obtains nonpublic personal information.

Amended by Chapter 542, 2025 General Session