Update Applicable to:
All businesses that produce or deliver commercial products or services that are intentionally targeted to Colorado residents and collect data of consumers in the state of Colorado
What happened?
On March 15, 2023, the Colorado Attorney General’s Office finalized rules implementing the Colorado Privacy Act (“CPA”). The finalized rules were released with an official redline that reflects prior revisions of the rules dated December 21, 2022, January 27, 2023, and February 23, 2023.
What are the details?
Effective July 1, 2023, The Colorado Privacy Act applies to “controllers” that conduct business in Colorado or produce or deliver commercial products or services that are intentionally targeted to Colorado residents and that either (1) control or process the personal data of 100,000 or more consumers during a calendar year or (2) derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of 25,000 or more consumers.
The law defines “consumers” to mean Colorado residents acting only in an individual or household context. It does not include Colorado residents acting in a commercial or employment context.
When determining whether the law applies, businesses should note that the CPA does not have a monetary threshold for applicability similar to the California Consumer Privacy Act’s (CCPA) $25,000,000 annual gross revenue threshold. Further, the law’s 100,000/25,000 consumer thresholds apply to personal data that is either controlled or processed. The CPA defines “process” to include not only data collection, but also its storage. In other words, businesses will need to be mindful of counting the data that they currently store, not just what they collect on an annual basis.
Below are some hyperlinks provided by one of our sources, Husch-Blackwell, which provides more information on specific subjects regarding this new law:
What businesses does the Colorado Privacy Act apply to?
How does the Colorado Privacy Act define personal data?
Does the Colorado Privacy Act exempt any types of businesses?
What rights does the Colorado Privacy Act provide to Colorado residents?
How does the Colorado Privacy Act define the “sale” of personal data?
How does the Colorado Privacy Act define targeted advertising?
How does the Colorado Privacy Act define profiling?
Does the Colorado Privacy Act require businesses to have online privacy policies?
Does the Colorado Privacy Act restrict data collection?
How is the Colorado Privacy Act enforced?
For more information, please see the links below:
Law Firm Links: Article 1 , Article 2, Article 3
What do employers need to do? Employers should review the links provided above and should review their data collection policies to ensure they will be in compliance with the law by July 1, 2023
Need help understanding how changes to employment laws will affect your business?
Learn more about how Vensure's Colorado PEO services can help you navigate complex employment laws and keep your business compliant.
This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.
