Policy Briefing — Colorado Privacy Act Signed
Colorado enacted SB21-190, establishing comprehensive consumer privacy rights, data controller duties, and attorney general rulemaking authority effective July 2023.
Governor Jared Polis signed the Colorado Privacy Act (CPA) on 7 Jul 2021, making Colorado the third U.S. state with omnibus consumer privacy legislation. The law grants residents rights to access, correction, deletion, portability, and opt-outs for targeted advertising, data sales, and profiling, while mandating data minimisation, risk assessments, and universal opt-out mechanisms for controllers.
- 7 Jul 2021 — CPA enacted. SB21-190 created controller and processor obligations, annual data protection assessments, and rulemaking authority for the attorney general and Department of Law.
- 2022 — Preliminary rulemaking. The attorney general launched stakeholder sessions and draft rules to clarify opt-out signals, profiling risk assessments, and loyalty programme disclosures.
- 1 Jul 2023 — Effective date. Controllers became subject to CPA rights requests, universal opt-out recognition, and enforcement powers including civil penalties.
Zeph Tech benchmarks CPA readiness alongside CCPA/CPRA and VCDPA requirements to align U.S. privacy operations with forthcoming federal proposals.