Colorado Advances Privacy Act Regulations

On December 5, 2024, the Colorado Department of Law (Department) adopted an amended draft of its latest proposed Colorado Privacy Act (CPA) regulations. This set of amended regulations follows a public comment period that concluded with a public hearing held on November 7, 2024. The Department has also provided a cover letter explaining how the regulations were revised based on feedback received during the comment period.

In Depth

As a refresher, the proposed regulations:

1. Require any controller (including employers) that collects biometrics to give a pre-collection notice to the data subject;
2. Impose new biometrics collection obligations on employers;
3. Require controllers to obtain consent to process the personal data of minors (consumers under age 18); and