The Colorado Privacy Act (CPA), passed in 2021, takes effect on July 1, 2023. The Colorado Privacy Act grants Coloradans five rights regarding their personal data:
- The right to opt out of sharing personal information for targeted advertising or the sale of personal data.
- The right to access their personal data.
- The right to correct any inaccuracies in their personal data.
- The right to request deletion of their personal data.
- The right to data portability.
The CPA excludes certain types of entities, including:
- Financial institutions and affiliates subject to the Gramm-Leach-Bliley Act.
- Air carriers subject to Federal Aviation Administration regulations.
- National securities associations registered under the Securities Exchange Act.
In addition, the CPA excludes certain types of personal data maintained in compliance with federal privacy laws, including the Health Information Portability and Accountability Act (HIPAA).
More information regarding the CPA and its July 1st enforcement can be found on the Colorado Attorney General’s website.