The Colorado Privacy Act (CPA) has officially finalized its rules as of March 15, 2023, when the Colorado Attorney General’s Office completed its review and submitted them to the Secretary of State. The finalized rules will be published later this month and will go into effect on the same day as the statute, July 1, 2023.
The Colorado Privacy Act seeks to protect consumers’ personal data and provide them with more control over their data. With the introduction of these new rules, businesses and organizations that handle personal data must ensure that they comply with the CPA to avoid any legal consequences.
As of July 1, 2023, when the Colorado Privacy Act (CPA) goes into effect, consumers will have more control over their personal data. Businesses and other organizations that control data, known as controllers, will be obligated to provide consumers with a privacy notice that includes the types of personal data collected or processed, the purpose for which that personal data is processed, the type of data shared with third parties, the categories of third parties it is shared with, and how people can access, correct, delete, and download and transmit their personal data.
Moreover, businesses and organizations will have to disclose clearly and conspicuously if any personal data is sold or processed for targeted advertising and how people can opt-out of having their data sold or processed. Consumers can opt-out through businesses’ privacy notices, a readily accessible location outside the privacy notice, or through a universal opt-out option that applies to all businesses subject to the CPA.
Before the CPA goes into effect, the Colorado Attorney General’s Office will create and provide rules that set forth additional details on the steps controllers must take to ensure that consumers can effectively exercise their rights. These rules will be developed with input from consumers and other stakeholders, including details relating to the universal opt-out mechanism.
As more states develop their own consumer privacy laws, there have been calls for a single federal standard. Last year, the American Data Privacy and Protection Act (“ADPPA”) was introduced in the House of Representatives on June 21, 2022, and was amended by the Committee on Energy and Commerce on December 30, 2022. A recent hearing by the Innovation, Data, and Commerce Subcommittee of the House Committee on Energy and Commerce indicates renewed interest in the ADPPA as a viable path forward for federal privacy legislation.
