An Update on the Colorado Privacy Act

Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends

On June 8, 2021, the Colorado legislature passed the Colorado Privacy Act (CPA). Since we first reported on its introduction, the CPA has undergone a number of revisions. Initial amendments made the CPA more business-friendly. Recent amendments, however, have been pro-consumer. For example, the Senate's final version of the CPA restored the opt-in requirement for controllers to obtain consent from consumers before collecting sensitive data, which the Business, Labor & Technology Committee had replaced in favor of a notice and opt-out standard.

The Senate modified the following provisions of the CPA:

  • "Consent" is modified and defined as a "clear, affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement, such as a written statement, including by electronic means or other clear, affirmative action by which the consumer signifies agreement to the processing of personal data relating to the consumer for a narrowly defined particular purpose."
    • Consent does not include acceptance of "general or broad terms of use," passive acceptance such as "hovering over, muting, pausing, or closing" content, or an "agreement obtained through dark patterns."
      • "Dark patterns" refers to a "user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision making, or choice."
    • The definition of "sale" no longer applies only to licensing or selling to third parties.
    • The "right to deletion" no longer applies only to data "provided to the controller."
    • The CPA no longer contains any reference to "pseudonymous data."

The Senate added the following new provisions to the CPA:

  • A relationship between a processor and controller must be governed by a contract abiding by the requirements laid out in the CPA.
  • Controllers have 60 days to cure any violation. This provision will be repealed on January 1, 2025.
  • Controllers must "provide a clear and conspicuous method to exercise the right to opt-out of the processing" of personal data used for targeted advertising or sale.
  • Effective January 1, 2024, controllers processing personal data for targeted advertising or sale must allow consumers to opt-out of processing through a "user-selected universal opt-out mechanism." Technical specifications and regulations for this mechanism will be rolled out through the Attorney General by December 31, 2023.

Final Amendments in the House

The CPA was introduced in the House and assigned to the House Committee on Finance on May 27, 2021. The House Finance Committee, as well as the House Committee of the Whole, made a handful of amendments to the bill, including:

  • Restoring to the definition of "pseudonymous data" and providing that rights within the bill do not apply to such data;
  • Restating that the CPA does not provide for a private right of action;
  • Providing that the CPA does not apply to data maintained by a "state institution of higher education" and various other state and governmental entities; and
  • Allowing the Attorney General to adopt rules covering the issuance of opinion letters and interpretative guidance beginning on January 1, 2025.

If signed into law by the Governor, the CPA will be effective on July 1, 2023.

DISCLAIMER: Because of the generality of this update, the information provided herein may not be applicable in all situations and should not be acted upon without specific legal advice based on particular situations.

© Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends | Attorney Advertising

Written by:


Hinshaw Privacy & Cyber Bytes - Insights on Compliance, Best Practices, and Trends on:

Reporters on Deadline

"My best business intelligence, in one easy email…"

Your first step to building a free, personalized, morning email brief covering pertinent authors and topics on JD Supra:
*By using the service, you signify your acceptance of JD Supra's Privacy Policy.
Custom Email Digest
- hide
- hide

This website uses cookies to improve user experience, track anonymous site usage, store authorization tokens and permit sharing on social media networks. By continuing to browse this website you accept the use of cookies. Click here to read more about how we use cookies.