63A-20-401. Requirements for digital wallet providers.
346 words·~2 min read·
/ut/title-63a/chapter-20/63a-20-401·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Effective 5/6/2026
63A-20-401. Requirements for digital wallet providers.
(1)A digital wallet produced by a digital wallet provider shall:
(a)incorporate state-of-the-art safeguards for protecting an individual's identity;
(b)process an individual's identity attributes in a secure manner;
(c)comply with the requirements of this part through technological means where possible;
(d)be tamper resistant;
(e)support online and offline presentation of a state-endorsed digital identity;
(f)maintain a secure log:
(i)with sufficient information for the holder to know:
(A)what identity attributes were provided; and
(B)the verifier or relying party the identity attributes were provided to;
(ii)accessible only to the holder;
(iii)exportable only by the holder; and
(iv)deletable only by the holder;
(g)enable a holder to:
(i)selectively disclose an individual's identity attributes; or
(ii)demonstrate that the individual meets a specified minimum age without disclosing the individual's age or birth date; and
(h)allow a presentation of a state-endorsed digital identity by a digital guardian.
(2)A digital wallet provider may only process an individual's identity attributes from a state digital identity if:
(a)the processing is necessary for a presentation;
(b)the holder has received conspicuous notice of:
(i)what identity attributes are collected from the state digital identity;
(ii)how the identity attributes are used;
(iii)the purpose for which the identity attributes are processed; and
(iv)how long the identity attributes are retained; and
(c)the holder consents to the processing of the individual's identity attributes.
(3)Information provided by a holder to a digital wallet provider for the purpose of creating or using a digital identity may only be:
(a)processed for the primary purpose for which the holder disclosed the information; and
(b)used, retained, sold, or shared:
(i)as expressly authorized by the holder; or
(ii)if required by law.
(4)Nothing in this section relieves a digital wallet provider from complying with the requirements of Title 13, Chapter 44, Protection of Personal Information Act, or Title 13, Chapter 61, Utah Consumer Privacy Act.
Enacted by Chapter 436 , 2026 General Session