Colorado Privacy Law Regulations Finalized: Time To Review Information Practices

Listen to this post

Colorado's Privacy Act regulations have now been finalized, in advance of the law's July 1 effective date. As we have written previously, the Colorado privacy law applies to companies that conduct business in the state and either (1) control or process personal data of 100,000 Colorado consumers during a calendar year, or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of at least 25,000 Colorado consumers. The law mirrors in many ways the comprehensive privacy laws of other states.

Additionally, among its many requirements, the law holds that by July 1, 2024, consumers must be able to opt-out of targeted advertising or the sale of information through a universal opt-out mechanism. The Attorney General was to promulgate and adopt rules relating to the law's opt-out mechanisms by July 1, 2023. Those rules were to establish technical opt-out