Two years ago this month, the state of Colorado joined California and Virginia in the passage of broad consumer protection legislation when the Colorado Privacy Act (CPA) was signed into law.
The CPA went into effect on July 1, 2023, and last week Colorado Attorney General Phil Weiser was prompt in his reminder to businesses that his office will begin enforcement.
In a statement issued on July 12, Weiser noted that the CPA is a critical tool to protect consumers’ data and privacy but that his office’s enforcement approach “will not seek to make life challenging for organizations that are complying with the law, but rather will seek to support such efforts.” Weiser said, “if we become aware of organizations that are flouting the law or refusing to comply with it, we are prepared to act.”
Among other things, the CPA provides Colorado residents with the right to opt out of targeted advertising and the sale of their personal data. Key obligations under the CPA include requirements to:
- Provide consumers with clear, understandable, and transparent information about how and why they collect, store, use, share, and sell personal data
- Respond to consumer requests to access, delete, correct, and get a portable copy of their personal data
- Allow consumers to opt out of the sale of personal data as well as targeted advertising and certain kinds of profiling
- Obtain consent before collecting or using sensitive data
- Only collect the minimum amount of personal data necessary from consumers
Beginning on July 1, 2024, controllers will need to honor user-selected universal opt-outs for targeted advertising and sales.
The Colorado Attorney General and local district attorneys have exclusive authority to enforce the CPA and can seek significant monetary penalties for non-compliance. In addition, several other states have joined the list of those that have enacted comprehensive privacy laws and may soon provide indications of their enforcement priorities.
