On September 30, 2022, the Colorado Attorney General
("AG") published draft regulations under the Colorado
Privacy Act ("CPA"). The 38 page draft is quite detailed,
proposing specific requirements on privacy policy disclosures,
consumer rights, data protection assessments, dark patterns and
"profiling," some of which will be a substantial
compliance lift for many companies. While many businesses have
focused on the looming January 1, 2023, deadline for compliance
with the California Privacy Rights Act, the draft CPA rules signal
that Colorado intends to become a significant privacy enforcer in
its own right.
Stakeholders may comment on the proposed regulations from
October 10, 2022, to February 1, 2023, when the Colorado AG will
hold a public hearing on the draft rules. In advance of
the rulemaking hearing, the department is holding additional
virtual stakeholder meetings will take place in November, with
comments due by November 7, 2022. The final form of
