Colorado Passes Privacy Bill: How Does It Stack Up Against California And Virginia?

The Colorado Legislature recently passed the Colorado Privacy Act ("ColoPA"), joining Virginia and California as states with comprehensive privacy legislation. Assuming Colorado Governor Jared Polis signs the bill ( SB 21-190) into law, ColoPA will go into effect on July 1, 2023.

How does the measure stack up against the VCDPA and the CCPA (as amended by CPRA)? The good news is that, in broad terms, ColoPA generally does not impose significant new requirements that aren't addressed under the CCPA or VCDPA. Below, we compare key provisions of ColoPA against California's and Virginia's laws and call attention to a few areas where Colorado has struck out on its own.

• Establishing consumer rights. As with the VCDPA and the CCPA, ColoPA provides rights for access, deletion, correction, portability, and opt out for targeted advertising, sales, and certain profiling decisions that have legal or similar effects. Unlike CCPA, Colorado consumers can only use an