Video Surveillance Laws in Utah: A Compliance Reference for Security Teams

Enterprise camera programs in Utah must comply with several overlapping laws. A camera that is lawful under one authority can violate another and create criminal and civil exposure. A defensible camera program must satisfy several distinct legal tests.

Key Takeaways

• In Utah, posted notice never legalizes a camera in a restroom, locker room, changing room, or shower.
• Outside statutory privacy spaces, camera placement turns on whether an individual has a reasonable expectation of privacy.
• The Utah Consumer Privacy Act excludes employee data and excludes recordings from its biometric-data definition, so identifying a consumer from footage does not by itself trigger sensitive-biometric-data duties.
• Utah recodified privacy offenses into a new chapter of the criminal code, so camera policies built on the previous section numbers now cite superseded law.

How Utah Regulates Video Surveillance

Utah surveillance rules come from criminal voyeurism and privacy offenses in Title 76, the Utah Consumer Privacy Act, and federal labor and health-privacy law.

Effective May 7, 2025, the Utah recodification law moved its voyeurism and privacy offenses into Title 76, Chapter 12. It split former § 76-9-702.7 into recorded voyeurism at § 76-12-307, non-recording voyeurism at § 76-12-306, and distribution of images at § 76-12-308. Former § 76-9-402 became § 76-12-302.

Permitted and Prohibited Camera Locations

Video-only cameras should be evaluated under any applicable video-specific privacy rules, separate from audio-recording consent requirements.

Utah's privacy space definition, carried forward on recodification and now incorporated into § 76-12-309, covers restrooms and any space containing a toilet, dressing rooms, fitting rooms, locker rooms, changing facilities, and any room with a shower. By statute, an individual in a changing room has a reasonable expectation of privacy, which satisfies the privacy element of voyeurism. Section 76-12-302 requires consent from those entitled to privacy, so a posted sign should not substitute obtaining that consent.

Outside privacy spaces, the privacy standard turns on whether a person may reasonably expect to be safe from intrusion or surveillance. Silent video surveillance in common areas may therefore be lawful depending on the circumstances.

Workplace Surveillance and Employee Privacy

For video monitoring in common work areas, the cited Utah Title 76 provisions do not state a general advance-notice duty.

National Labor Relations Board General Counsel memorandum GC 23-02 treats workplace surveillance that tends to interfere with employees' Section 7 rights to organize and engage in protected concerted activity as presumptively unlawful. Where an employer's legitimate business need outweighs those interests, the memorandum expects the employer to disclose to workers the surveillance technologies in use, the reasons for using them, and how the resulting data will be handled. This position reflects the General Counsel's enforcement priorities rather than binding Board precedent, so its practical weight depends on how the Board rules in future cases.

Collective bargaining agreements can further restrict camera use, for example by limiting footage review to specific triggering incidents rather than routine monitoring.

Notice and Signage Obligations

The cited Utah Title 76 provisions do not state a general signage or disclosure duty for ordinary commercial premises. Organizations may document their monitoring practices through handbook language and orientation briefings. They may also place signs at entry points and camera locations. Utah's school camera rule, R698-13-5, requires schools to install cameras at each entrance, retain recordings for 14 days, and make them available to the division on request.

Assisted living facilities under the assisted living law, § 26B-2-236, may require a room sign, and resident-installed cameras need written notice and roommate consent.

Data Handling Under the Utah Consumer Privacy Act

Separate from premises signage, data-use notices may apply when footage is used to identify consumers. The Utah Consumer Privacy Act (UCPA), available in the Utah Code, took effect December 31, 2023. It reaches businesses that meet the statute's revenue and data-processing thresholds and do business in Utah or target Utah residents. The statute's other applicability criteria must also be satisfied. The consumer definition excludes employee, job applicant, and business-to-business data.

The UCPA's definitions section excludes photographs and video or audio recordings from biometric data, but data generated from them may qualify as biometric data when it is generated or used to identify a specific consumer. Whether a controller's processing involves personal data elsewhere under the UCPA requires a separate analysis. Identifying a consumer from footage alone does not convert the excluded recording into sensitive biometric data. Other biometric data processed to identify a specific individual is sensitive data, and a controller may not process it without first presenting the consumer with clear notice and an opportunity to opt out. The UCPA provides for attorney general enforcement and creates no private right of action.

Outside the school-camera rule, the cited Utah provisions do not state a retention period for ordinary private-facility footage. For covered entities and business associates, electronically stored footage that constitutes electronic protected health information (ePHI) is subject to the applicable physical safeguards under the Health Insurance Portability and Accountability Act (HIPAA) in Title 45 of the Code of Federal Regulations (CFR), § 164.310(a)(1), which require policies limiting physical access to electronic information systems and the facilities housing them.

Penalties and Civil Exposure

When placement crosses into prohibited recording, the analysis should shift from camera placement rules to applicable criminal privacy and surveillance statutes. Distribution of images is a separate offense under § 76-12-308, a third-degree felony, elevated to a second-degree felony where the subject meets that threshold.

Utah law addresses some recording issues elsewhere, including audio-recording consent under Utah Code § 77-23a-4.

Building a Compliant Camera Program

Given that exposure, retention settings belong alongside a counsel-approved litigation-hold process. As counsel-reviewed risk-management guidance, organizations can use that process to prevent routine settings from overwriting footage identified for preservation after litigation is reasonably anticipated or a hold notice is received.

• Security teams should audit camera field-of-view records against applicable privacy-space requirements.
• Organizations should re-confirm camera field of view after any reposition.
• Employers should route union notification and bargaining through labor counsel before installing covert cameras in an organized workplace.
• Security and privacy teams should follow the Security Industry Association's Code of Practice when conducting a privacy impact assessment of footage collection, use, sharing, and retention.
• Organizations operating across state lines should obtain counsel's conflict-of-laws analysis for surveillance practices that may implicate multiple jurisdictions.

Keeping Utah Surveillance Policies Current

Utah camera compliance starts with location: privacy spaces require consent, while common-area monitoring depends on reasonable expectations of privacy. Teams should also address applicable data-use notices, access safeguards, retention, and litigation holds. Because Utah's surveillance framework can change, security teams should assign ownership for scheduled legal review, field-of-view verification, configuration control, and updates to statutory citations.

Frequently Asked Questions

What specific revenue and data-processing thresholds must a business meet for the Utah Consumer Privacy Act to apply to its video surveillance practices?

The UCPA applies to businesses that conduct business in Utah or target Utah residents, have annual revenue of $25 million or more, and either control or process the personal data of 100,000 or more Utah consumers annually, or control or process the personal data of 25,000 or more consumers while deriving over 50 percent of gross revenue from selling personal data.

How should organizations update their existing camera policies to reflect Utah's 2025 recodification of voyeurism and privacy offenses into Title 76, Chapter 12?

Organizations must replace outdated statutory citations in policies, training materials, and incident-response protocols with Title 76, Chapter 12 references. Legal teams should verify policy substance aligns with recodified provisions, as legislative revisions may alter enforcement scope or penalty structures beyond renumbering.

Can an employer legally use covert cameras in a unionized workplace in Utah, and what steps must be taken before installing them?

Covert cameras in a unionized Utah workplace risk unfair labor practice charges. In unionized workforces, NLRB precedent can require employers to notify the union and bargain before installation, as camera deployment may affect working conditions. Failure to bargain can result in Board-ordered removal and remedies for affected employees.