Two years ago this month, the state of Colorado joined California and Virginia in the passage of broad consumer protection legislation when the Colorado Privacy Act (CPA) was signed into law.

The CPA went into effect on July 1, 2023, and last week Colorado Attorney General Phil Weiser was prompt in his reminder to businesses that his office will begin enforcement.

In a statement issued on July 12, Weiser noted that the CPA is a critical tool to protect consumers’ data and privacy but that his office’s enforcement approach “will not seek to make life challenging for organizations that are complying with the law, but rather will seek to support such efforts.” Weiser said, “if we become aware of organizations that are flouting the law or refusing to comply with it, we are prepared to act.”

Among other things, the CPA provides Colorado residents with the right to opt out of targeted advertising and the sale of their personal data. Key obligations under the CPA include requirements to:

Provide consumers with clear, understandable, and transparent information about how and why they collect, store, use, share, and sell personal data
Respond to consumer requests to access, delete, correct, and get a portable copy of their personal data
Allow consumers to opt out of the sale of personal data as well as targeted advertising and certain kinds of profiling
Obtain consent before collecting or using sensitive data
Only collect the minimum amount of personal data necessary from consumers

Beginning on July 1, 2024, controllers will need to honor user-selected universal opt-outs for targeted advertising and sales.

The Colorado Attorney General and local district attorneys have exclusive authority to enforce the CPA and can seek significant monetary penalties for non-compliance. In addition, several other states have joined the list of those that have enacted comprehensive privacy laws and may soon provide indications of their enforcement priorities.

For specific questions about what this means for you and your business, please contact Alysa Hutnik at ahutnik@kelleydrye.com.

In addition, please join us on July 24 for a webinar featuring special guest speakers Colorado Attorney General Phil Weiser and Nathan Blake, Deputy Attorney General for Consumer Protection, as they join Kelley Drye State Attorneys General practice Co-Chair Paul Singer, Special Counsel Abby Stempson, and Senior Associate Beth Chun for a discussion on a variety of important consumer protection topics. You may register here.

Colorado Consumer Data Privacy Law is in Effect