Attorney General’s Office files finalized Colorado Privacy Act rules

March 15, 2023 (DENVER) – The Colorado Attorney General’s Office filed the finalized Colorado Privacy Act (CPA) Rules with the Colorado Secretary of State’s Office this week, following completion of a review confirming the rules are legal and constitutional.

The rules will be published in the Colorado Register later this month, and they will go into effect July 1, 2023, making Colorado the third state to enact a general state privacy law and the second to draft related rules.

The CPA grants Coloradans rights over their own personal data. The law allows Coloradans to access the data businesses, nonprofits, and other entities collect about them and to have them delete or correct that data. It also provides Coloradans with additional control over the way that their personal data is used, allowing them to opt out of the sale of their personal data and use of their personal data for targeted advertising and profiling. The law requires companies to tell Coloradans how they use personal data and to take precautions that will reduce the risk of data collection harming consumers. Finally, the law grants the attorney general the authority to hold entities accountable for failing to comply with these obligations and draft rules to provide clarity and guidance for compliance.

The Department of Law hosted five virtual and in-person public input sessions and a rulemaking hearing, inviting members of the public to offer their comments and feedback on the rulemaking and draft rules. The department also released three versions of draft rules implementing feedback and received 137 written comments about the drafts through an online portal, all of which are available for review on the department’s website.

“I am grateful for the dedication and engagement from the public throughout this rulemaking process,” said Attorney General Phil Weiser. “Attorneys in my office thoughtfully incorporated feedback throughout the rulemaking to carefully craft rules to both protect consumers and ensure businesses have reasonable direction as they manage Coloradans’ information.”

Highlights from the rules include:

For more information, or to view previous drafts of the rules, go to coag.gov/cpa.