Privacy Bill Essentials: An Update on the Colorado Privacy Act

June 9, 2021 | Updated July 8, 2021
Hinshaw Privacy & Cyber Bytes

Update: Governor Jared Polis signed the Colorado Privacy Act on July 8, 2021.

On June 8, 2021, the Colorado legislature passed the Colorado Privacy Act (CPA). Since we first reported on its introduction, the CPA has undergone a number of revisions. Initial amendments made the CPA more business-friendly. Recent amendments, however, have been pro-consumer. For example, the Senate's final version of the CPA restored the opt-in requirement for controllers to obtain consent from consumers before collecting sensitive data, which the Business, Labor & Technology Committee had replaced in favor of a notice and opt-out standard.

The Senate modified the following provisions of the CPA:

The Senate added the following new provisions to the CPA:

Final Amendments in the House

The CPA was introduced in the House and assigned to the House Committee on Finance on May 27, 2021. The House Finance Committee, as well as the House Committee of the Whole, made a handful of amendments to the bill, including:

If signed into law by the Governor, the CPA will be effective on July 1, 2023.