On July 7, 2021, Governor Polis signed Senate Bill 21-190: Protect Personal Data Privacy establishing the Colorado Privacy Act (CPA). The CPA tasked the Colorado Attorney General with implementing and enforcing the CPA, including adopting new rules. The CPA is a part of the State of Colorado’s Consumer Protection Act and goes into effect July 1, 2023.
The CPA grants Colorado Consumers new rights with respect to their personal data, including the right to access, delete, and correct their personal data as well as the right to opt out of the sale of their personal data or its use for targeted advertising or certain kinds of profiling. The CPA also places new obligations on covered entities to safeguard personal data, including the requirement to give Coloradans meaningful information about the collection and use of their data, to conduct data protection assessments, and to obtain consent before processing certain sensitive personal data.
The proposed draft rules for the CPA were published by the Secretary of State on Oct. 10, 2022, and the final rules were filed with the Secretary of State March 15, 2023. These include the required rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer’s affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data (6-1-1313(2), C.R.S.). The final CPA rules, filed with the Colorado Secretary of State, can be found here.
The text of the Colorado Privacy Act (Senate Bill 21-190) is available here.
On July 12, 2023, Attorney General Weiser announced the launch of enforcement of the CPA. As part of that enforcement effort, the Department began mailing letters to businesses focused on educating them about the law and their new legal obligations. You can read examples of those letters here:
- Notice of Application Letter Example 1
- Notice of Application Letter Example 2
- Notice of Application Letter Example 3