Colorado Finalizes Regulations For Colorado Privacy Act

On Wednesday, March 15, the Colorado Attorney General's Office announced the finalization of the Colorado Privacy Act Rules ("Rules"). The Rules implement the Colorado Privacy Act (CPA), a comprehensive privacy law enacted in 2021. Both the CPA and the Rules will enter into effect on July 1, 2023.

Businesses should familiarize themselves with the Rules, as they clarify and expand upon the requirements articulated in the CPA. Moreover, while the Rules cover much of same ground as the California Privacy Rights Act (CPRA) regulations recently approved by the California Privacy Protection Agency (CPPA), the two regulatory frameworks differ in several important respects. Most notably, the Colorado Rules addresses two topics — data protection assessments and profiling — that California regulators are only beginning to consider, while the CPRA regulations include provisions specific to enforcement and third-party processing absent from the Colorado Rules. Thus, while