{"data":{"id":"us-ut/utah-code-63a-20-401","jurisdiction":"us-ut","citation":"Utah Code § 63A-20-401","heading":"Requirements for digital wallet providers.","body":"(1) A digital wallet produced by a digital wallet provider shall:\n(a) incorporate state-of-the-art safeguards for protecting an individual's identity;\n(b) process an individual's identity attributes in a secure manner;\n(c) comply with the requirements of this part through technological means where possible;\n(d) be tamper resistant;\n(e) support online and offline presentation of a state-endorsed digital identity;\n(f) maintain a secure log:\n(i) with sufficient information for the holder to know:\n(A) what identity attributes were provided; and\n(B) the verifier or relying party the identity attributes were provided to;\n(ii) accessible only to the holder;\n(iii) exportable only by the holder; and\n(iv) deletable only by the holder;\n(g) enable a holder to:\n(i) selectively disclose an individual's identity attributes; or\n(ii) demonstrate that the individual meets a specified minimum age without disclosing the individual's age or birth date; and\n(h) allow a presentation of a state-endorsed digital identity by a digital guardian.\n(2) A digital wallet provider may only process an individual's identity attributes from a state digital identity if:\n(a) the processing is necessary for a presentation;\n(b) the holder has received conspicuous notice of:\n(i) what identity attributes are collected from the state digital identity;\n(ii) how the identity attributes are used;\n(iii) the purpose for which the identity attributes are processed; and\n(iv) how long the identity attributes are retained; and\n(c) the holder consents to the processing of the individual's identity attributes.\n(3) Information provided by a holder to a digital wallet provider for the purpose of creating or using a digital identity may only be:\n(a) processed for the primary purpose for which the holder disclosed the information; and\n(b) used, retained, sold, or shared:\n(i) as expressly authorized by the holder; or\n(ii) if required by law.\n(4) Nothing in this section relieves a digital wallet provider from complying with the requirements of Title 13, Chapter 44, Protection of Personal Information Act, or Title 13, Chapter 61, Utah Consumer Privacy Act.","path":["Title 63A Utah Government Operations Code","Chapter 63A-20 State-Endorsed Digital Identity","Part 63A-20-4 Digital Wallet Providers"],"source_url":"https://le.utah.gov/xcode/Title63A/Chapter20/63A-20-S401.html","current_through":"2026 General Session","vintage":"","retrieved_at":"2026-09-03T11:34:33Z","sha256":"62dfb11f516c4a806e52aa635d6058183f8c07a9878033f6c8e9b9cc0ae5cb5b","source_id":"us-ut","stale":false,"prev":"us-ut/utah-code-63a-20-305","next":"us-ut/utah-code-63a-20-501"},"notice":"GroundRules: Original legal text. Not legal advice."}