On July 1, 2023, the Colorado Privacy Act (ColoPA) and Connecticut Data Privacy Act (CTDPA) will go into effect, joining California and Virginia, whose data privacy laws are already in effect. Notably, while the California Privacy Rights Act (CPRA) amendments to the California Consumer Privacy Act (CCPA) went into effect on January 1, 2023, those amendments will also become enforceable starting July 1, 2023. While there are a number of compliance obligations that overlap among these laws, businesses should be aware of the key obligations for ColoPA, specifically the ColoPA Rules that were finalized just a few months ago, and the CTDPA, since they may require businesses to update their privacy notices and practices. This alert provides a high-level summary of significant obligations from the ColoPA law and regulations and the CTDPA to aid companies preparing to be in compliance by the July 1st deadline.

Colorado

As covered in prior alerts,¹ entities subject to ColoPA, which include the ColoPA Rules finalized on March 15, 2023, can face civil penalties of up to $20,000 per violation for noncompliance if the violation cannot be cured within 60 days. As such, businesses should go through these key takeaways to ensure they have properly considered the obligations for their companies:

• Privacy Notice Content Requirements. Unlike the CCPA, ColoPA requires controllers to map each category of personal data collected to the controller’s specific use of that data. The ColoPA also requires controllers to notify consumers of material changes to its privacy notice, such as when the controller begins to share personal data with new categories of third parties and when a controller processes personal data for a new purpose.
• Consent. ColoPA requires controllers to obtain opt-in consent prior to processing a variety of data, including sensitive data, personal data concerning known children, and processing personal data for new purposes (even if personal data was collected prior to July 1, 2023). The ColoPA also establishes specific requirements for how to obtain valid, informed consent.
• Consent for Previously Collected Data, Reseeking Consent, and Refreshing Consent. Companies should also take note of the many other requirements for establishing and maintaining proper consent obligations. Most notably:
  • Controllers must refresh previously obtained consents if the consumer has not interacted with the controller in the past 24 months unless the consumer has the ability to update their opt-out preferences at any time through a user-controlled interface.
  • Controllers that do not obtain valid consent to continue processing sensitive data that was collected prior to July 1, 2023, will have until July 1, 2024, to obtain that consent.
  • Controllers can also reseek a valid form of consent from consumers if they have a “reasonable belief” that the consumer intended to opt back into the sale of personal data or processing of personal data for targeted advertising.
• Right to Opt Out. Like the CCPA, ColoPA allows consumers to opt out of the sale of their personal data. Although consumer opt-out rights under the CCPA now extend to the “sharing” of personal data for targeted advertising purposes,² ColoPA goes a step further and allows consumers to opt out of any use or any other processing of personal data for the purposes of targeted advertising. The ColoPA confirms that “Your Privacy Choices” (among other examples) can be a valid opt-out link text, which aligns with one of the options provided by the CCPA.
• Data Minimization. Businesses that store personal data, including photographs, audio or voice recordings, and biometric identifiers, will need to annually assess whether such storage is necessary, adequate, or relevant for the stated processing purpose.
• Data Protection Assessments. The ColoPA Rules require companies to conduct data protection assessments for processing activities conducted after July 1, 2023, that “present[] a heightened risk of harm” to consumers. ColoPA provides much more prescriptive guidance than the CCPA and the Virginia Consumer Data Protection Action (VCDPA) on how to conduct these assessments.

Connecticut

While we previously covered the scope and applicability of the CTDPA here, companies should be aware that just a few weeks ago, the Connecticut state legislature amended the CTDPA by creating new data privacy requirements for consumer health data and children’s personal data.³ The provisions related to processing of consumer health data will take effect on July 1, 2023, whereas other provisions related to the use and processing of children’s data will go into effect in July and October of 2024. From the period of July 1, 2023-December 31, 2024, the Connecticut Attorney General will provide companies with a notice of alleged violations and a 60-day cure period, if the attorney general determines that a cure is possible. But beginning on January 1, 2025, the attorney general will have discretion on whether to grant a controller or processor an opportunity to cure.

Companies that have already begun preparing for compliance with the laws in Colorado and Virginia will likely still require additional updates to comply with the CTDPA. Below, we summarize the major differences between these laws and the key obligations from the CTDPA passed on May 10, 2022, and as amended on June 2, 2023.

• Expanded Definition of Sensitive Data. The CTDPA requires controllers to obtain consent before processing sensitive data, consistent with the VCDPA and ColoPA. As amended, the CTDPA’s definition of “sensitive data” is expanded to include “consumer health data”⁴ and “data concerning an individual's status as a victim of a crime.”
• Right to Opt Out. Like Colorado and Virginia, Connecticut residents will have the right to opt out of personal data sales, targeted advertising, and profiling. Notably, however, the CTDPA does not require that opt-outs be authenticated like ColoPA.
• New Prohibitions on the Disclosure of Consumer Health Data. As amended, the CTDPA adds a new section outlining specific requirements related to consumer health data, including prohibiting persons from: 1) providing employees or contractors with consumer health data unless they are subject to a contractual or statutory duty of confidentiality; 2) using geofences within 1,750 feet of mental, reproductive, and sexual health facilities “for the purpose of identifying, tracking, collecting data from or sending any notification to a consumer regarding the consumer's consumer health data”; and 3) selling consumer health data without first obtaining consumer consent.

Businesses should not delay in addressing some or all of these new obligations until July 1. Companies that updated their notice and practices for January 2023, when the CPRA and VCPDA went into effect, with the aim to be compliant throughout 2023 will almost certainly need to address the many developments since then and should revisit their compliance practices.

^[1] We previously covered the Colorado AG’s rulemaking process and pre-rulemaking considerations in the following Wilson Sonsini Alerts: “Colorado AG’s Office Announces Final Colorado Privacy Act Rules: Key Takeaways,” “Colorado Attorney General’s Office Releases Third Version of Draft Rules for Colorado Privacy Act: Key Takeaways,” “Colorado Attorney General’s Office Releases Modified Draft Rules for Colorado Privacy Act: Key Takeaways,” “Colorado Attorney General Announces Privacy Rulemaking,” and “Colorado Attorney General Issues Pre-Rulemaking Considerations for the Colorado Privacy Act.” We also provided an overview of the ColoPA’s key requirements in another Wilson Sonsini Alert, “Colorado Becomes Third State to Pass New General Privacy Law.”

^[2]Referred to as “cross-context behavioral advertising” in the CCPA.

^[3]See passed Senate Bill 3 (enacted on June 2, 2023).

^[4]Defines “consumer health data” as “any personal data that a controller uses to identify a consumer's physical or mental health condition or diagnosis, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.”