Colorado Attorney General Launches Enforcement of Colorado Privacy Act
On July 1, 2023 the Colorado Privacy Act (CPA) went into effect and became enforceable. On July 12, 2023, Colorado Attorney General (AG) Phil Weiser officially launched enforcement of the CPA, by sending out an initial round of letters educating businesses that operate in Colorado on their new legal obligations under the CPA. The letters emphasized (1) obligations relating to the collection and use of sensitive data, including the requirement to obtain Colorado residents’ (“Consumers“) consent prior to collecting sensitive data, and (2) the obligation to allow Consumers to opt-out of targeted advertising and profiling.
The CPA applies to non-exempted businesses that operate in Colorado or target Consumers and either (1) collect more than 100,000 Consumers’ data annually, or (2) receive revenue or otherwise benefit from the sale of personal data and process the personal data of more than 25,000 Consumers (i.e., covered businesses). CPA obligations only apply to Consumers acting in an individual or household capacity (e.g., when browsing the internet or signing up for a retail rewards program) and do not apply to personal data that is collected in a commercial or employment context.
The Colorado AG’s July 12th press release focused on a set of privacy-related obligations under the CPA that are now placed on covered businesses under the law, including but not limited to:
- Providing Consumers with clear, understandable, and transparent information about how and why they collect, store, use, share, and sell personal data;
- Responding to Consumers’ requests to access, delete, correct, and obtain a copy of their personal data;
- Allowing Consumers to opt-out of the sale of personal data, as well as targeted advertising and certain kinds of profiling;
- Obtaining consent before collecting or using sensitive data; and
- Only collecting the minimum amount of personal data necessary from Consumers.
For more information on the CPA and/or obligations under other state comprehensive privacy laws, contact Fey LLC at [email protected].
Author Information
Will Davis – Associate Attorney at Fey LLC
