On July 7, 2021, the Colorado Privacy Act (CPA) was signed into law, joining California and Virginia as the only states to have passed comprehensive privacy legislation. The CPA goes into effect on July 1, 2023, which will be only six months after the January 1, 2023 effective date of both the California Privacy Rights Act (CPRA) (an update to the CCPA) and the Virginia Consumer Data Protection Act (VCDPA).

Although the CPA does have some of its own unique aspects, the good news is that it generally does not impose significant new requirements that are not already addressed under CCPA or VCDPA. For example, the CPA has data subject rights that are similar to the CCPA and VCDPA, which include the right to access, correct, delete, and opt out of the processing of personal data for targeted advertising and the sale of personal data. Consistent with the CCPA and VCDPA, under the CPA, controllers have 45 days to respond to consumer requests.