Colorado Joins The Consumer Privacy Bandwagon

Issue in Brief: Colorado is the third state to pass comprehensive consumer privacy legislation—the second in 2021—following the Virginia Consumer Data Protection Act (CDPA), which was signed into law earlier this year, and the California Consumer Privacy Act (CCPA), which passed in 2018.

On the Horizon: The Colorado Privacy Act largely tracks the prior state consumer privacy laws, requiring covered businesses to observe transparency requirements, honor consumer requests, and implement security controls to protect personal data. As a slight divergence, however, the CPA requires covered business to observe stricter consent requirements, implement “single-click” opt-out requests and readily-available appeals processes associated with consumer requests, and conduct—in certain instances—data protection impact assessments.