Colorado Privacy Act (CPA) Compliance

Summary

This practice note provides an overview of the scope, key terms, rights granted, obligations imposed, and enforcement measures available under the Colorado Privacy Act (CPA), Colo. Rev. Stat.§ 6-1-1301 through 6-1-1313. Colorado was the third state to enact comprehensive privacy legislation on July 8, 2021, behind California and Virginia (California Consumer Privacy Act (CCPA), California Privacy Rights Act (CPRA), Cal. Civ. Code § 1798.100 et seq., and Virginia Consumer Data Protection Act (VCDPA), Va. Code Ann. § 59.1-575 et seq.). Like its predecessors, the CPA offers broad personal data protections for consumers and imposes compliance obligations on those entities that control or process significant amounts of information. The CPA also gives rule-making authority to the Colorado Attorney General's office. Final rules (CPA Rules) were published on March 15, 2023. The rules are an integral part of the regulatory regime and contain additional duties and requirements, guidance, and ...