The Colorado Privacy Act (CPA) gives the Colorado Attorney General authority to adopt rules governing privacy. This includes general rules to carry out the CPA, specific rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer’s affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data, and rules that govern the process of issuing opinion letters and interpretive guidance.
The first CPA rulemaking began on Oct. 10, 2022, with the final hearing on Feb. 1, 2023. The finalized draft of the rules, filed with the Colorado Secretary of State, can be found here. The redline version, which shows changes made to the rules based on public input, can be found here.
The Colorado Privacy Act and proposed draft rules versions
- Jan. 27, 2023: An updated draft of the rules based on input received through Jan. 18, 2023, can be found here.
- Dec. 21, 2022: An updated draft of the rules based on input received through Dec. 2, 2022, can be found here.
- Oct. 10, 2022: The proposed draft rules can be found here or in the Colorado Register. The notice of proposed rulemaking, including specific questions to the public about the proposed draft rules, along with the Statement of Basis, Specific Statutory Authority, and Purpose, can be found here.
Get on the mailing list
If you wish to receive updates related the CPA or provide future rulemaking input, please click the button and complete the form to receive updates and notices.
INFORMATIONAL & RULEMAKING MEETING NOTICE SIGN-UP →
You can also receive additional notices about this rulemaking and other Colorado rulemakings by completing the form on the Department of Regulatory Agencies webpage.
Public input
The Colorado Department of Law accepted public input from March of 2022 through Feb. 3. 2023, and released several versions of the draft rules based on feedback from the public. Comments submitted to the Department of Law can be found here.
Rulemaking input sessions
The department hosted three virtual stakeholder meetings to discuss the CPA proposed draft rules. These stakeholder meetings were a forum for the department to gather feedback from a broad range of stakeholders for the development of rules to implement the CPA. Participants were asked to provide their input and insight, along with constructive feedback and suggestions, on the draft rules in an open discussion format.
After pre-registered speakers presented their comments, our office posed questions that were provided in our notice of proposed rulemaking, and questions stemming from our review of the rulemaking comments received to date. All attendees were welcome to provide input in response to those questions.
- Nov. 10, 2022, Consumer Rights and Universal Opt-Out Mechanisms: Click here to view the meeting.
- Nov. 15, 2022, Controller Obligations and Data Protection Assessments: Click here to view the meeting.
- Nov. 17, 2022, Profiling, Consent, and Definitions: Click here to view the meeting.
Pre-rulemaking input
The department hosted public input sessions on Wednesday, June 22 and Tuesday, June 28.
Click here to view the June 22 session, and here to view the June 28 session.
Colorado Privacy Act rulemaking hearing:
Cost-Benefit & Regulatory Analysis
Pursuant to section 24-4-103(2.5), C.R.S., anyone can request a cost-benefit analysis on proposed rules within five days of publication in the Colorado Register. The department received two timely requests for a cost-benefit analysis related to the proposed draft CPA rules. In response to those requests, the department compiled a comprehensive cost-benefit analysis, available here.
For more information about the cost-benefit analysis process, go to the Colorado Department of Regulatory Agencies website.
Pursuant to 24-4-103(4.5), C.R.S., any person may request a regulatory analysis of a proposed rule up to 15 days prior to the rulemaking hearing. The department did not receive any timely requests for a regulatory analysis. However, in support of public involvement and transparency during the rulemaking process, the department published the regulatory analysis as contemplated by the Colorado Administrative Procedure Act. Click here to view the regulatory analysis for the CPA rules.