On July 7, Colorado became the third state behind California and Virginia to adopt a comprehensive privacy law when Governor Jared Polis signed the Colorado Privacy Act into law. The CPA contains many similarities to the Virginia Consumer Data Protection Act (VCDPA) and the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CPRA). But there are several key differences, including with respect to the scope of certain of the consumer privacy rights and the contract terms required in agreements with processors. Like CPRA but unlike the VCDPA, the statute mandates a formal rulemaking process. Notably, the law does not contain a private right of action, but a violation of the CPA is considered a deceptive trade practice and may result in a fine of $20,000 per violation. The CPA takes effect July 1, 2023.
Please contact our Privacy, Cyber & Data Strategy Team with any questions or for further guidance.
