Colorado Privacy Act Signed by Governor

Written by Achieved Compliance

As part of the continued movement towards increased privacy regulation, Colorado joins California and Virginia as it becomes the third state to enact a comprehensive data privacy law.  On July 8, 2021, Colorado Governor Jared Polis signed SB21-190, the Colorado Privacy Act (“the Act”), into law. The Act will go into effect on July 1, 2023, with some specific provisions taking effect at later dates.

The Act applies to companies conducting business in Colorado or that produce or deliver commercial products or services targeted to Colorado residents.  These include those that either (1) control or process the personal data pertaining to at least 100,000 consumers during a calendar year; or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of at least 25,000 individuals.

The state’s Attorney General and its district attorneys will enforce the act – it does not provide for a private right of action.

The Act establishes obligations for companies and provides consumers with several new privacy rights, most notably it:

  • Establishes rights of data access, correction, deletion and portability for individuals;
  • Provides individuals with the right to opt out of (1) processing for targeted advertising, and (2) sale of personal data and profiling to arrive at decisions that result in legal or similarly significant effects on an individual;
  • Exempts from the Act’s obligations employee data, de-identified data and publicly available information, as well as data governed by laws such as HIPAA, GLBA and COPPA;
  • Distinguishes between data controllers and data processors, and outlines the duties of each;
  • Imposes a duty of transparency, requiring controllers to provide individuals with a privacy notice containing specified information;
  • Requires controllers to specify the purposes for which they are collecting and processing data;
  • Specifies that a controller must collect personal data that is adequate, relevant, and limited to what is reasonably necessary for the specified purposes of processing.
  • Prohibits controllers from processing personal data for purposes that are not reasonably necessary to or compatible with the specified purposes for which the data is processed unless consent is obtained;
  • Requires controllers to implement reasonable measures to secure personal data;
  • Prohibits controllers from processing personal data in violation of state or federal laws that prohibit discrimination;
  • Requires opt-in consent for the processing of sensitive data; and
  • Requires companies to carry out data protection impact assessments when processing presents a heightened risk of harm, such as processing personal data for targeted advertising, profiling, sale or processing sensitive data.

The Colorado Privacy Act also exempts a number of processing activities:

Such activities include performing internal operations, protecting a consumer’s vital interests, preventing and detecting fraud or other malicious, deceptive or illegal activity, and conducting internal research to improve, repair or develop products.

In totality, the Act provides for a sea change for companies processing data on Coloradans. Those companies who will fall outside the size exceptions for the number of Colorado consumers will have only two years to get up to speed.  As we have seen with California’s CCPA, getting started early will prove vital to ensuring compliance. Schedule your complimentary consultation with us today.

PRIVACY BLOG

New Fine Highlights the Necessity of EU-GDPR Article 27 Representation for US Companies](/content/blog/article-27-representation/index.html)

The Data Use and Access Act 2025 (DUAA) Key Changes to Data Protection Law](/content/blog/the-data-use-and-access-act-2025-duaa-key-changes-to-data-protection-law/index.html)

Privacy Compliance: Why Software Solutions Could Put You at Risk](/content/blog/privacy-compliance-why-software-solutions-could-put-you-at-risk/index.html)

The Troubling Cuts to Medical Research](/content/blog/the-troubling-cuts-to-medical-research/index.html)

ARE YOU CREATING PRIVACY ISSUES WITH AI?](/content/blog/are-you-creating-privacy-issues-with-ai/index.html)

European Commission Publishes New Standard Contractual Clauses and Guidance on Implementation](/content/blog/standard-contractual-clauses/index.html)

Dutch Data Protection Authority Fines Uber for Storing Personal Data in U.S. Without Required Protections](/content/blog/dutch-data-protection-authority-fines-uber-for-storing-personal-data-in-u-s-without-required-protections/index.html)

New York State Attorney General’s Office Issues Guidance on Tracking Technologies and Privacy](/content/blog/new-york-state-attorney-generals-office-issues-guidance-on-tracking-technologies-and-privacy/index.html)

Spanish Data Authority Fines Data Processor for Failure to Assess and Address Risks of Security Breach](/content/blog/spanish-data-authority-fines-data-processor-for-failure-to-assess-and-address-risks-of-security-breach/index.html)

Connecticut Attorney General’s Office Releases Report on New Data Privacy Law](/content/blog/connecticut-attorney-generals-office-releases-report-on-new-data-privacy-law/index.html)

Data Protection Commissioner of Ireland (DPC) Investigation Focuses on Location Data The DPC recently wrote to inform data controllers who may be in receipt of or sharing location data that it has initiated the regulatory assessment. It also notified organizations linked to those whose activities are the subject of the DPC assessment and stressed that failure to meet statutory obligations pertaining to processing of location data will result in regulatory action. read more](/content/blog/data-protection-commissioner-of-ireland-dpc-investigation-focuses-on-location-data/index.html)