Colorado's Draft Privacy Regulations Raise Compliance Challenges

On September 30, 2022, the Colorado Attorney General ("AG") published draft regulations under the Colorado Privacy Act ("CPA"). The 38 page draft is quite detailed, proposing specific requirements on privacy policy disclosures, consumer rights, data protection assessments, dark patterns and "profiling," some of which will be a substantial compliance lift for many companies. While many businesses have focused on the looming January 1, 2023, deadline for compliance with the California Privacy Rights Act, the draft CPA rules signal that Colorado intends to become a significant privacy enforcer in its own right.  

Stakeholders may comment on the proposed regulations from October 10, 2022, to February 1, 2023, when the Colorado AG will hold a public hearing on the draft rules.  In advance of the rulemaking hearing, the department is holding additional virtual stakeholder meetings will take place in November, with comments due by November 7, 2022.  The final form of