The Colorado Privacy Act went into effect on July 1, 2023. The bill creating the law was signed two years earlier in July, 2021. The law mandates that the Colorado Attorney General develop rules under the Act and enforce the Act as part of the Colorado Consumer Protection Act. Over the past couple years, rules have been drafted and the final rules adopted. 

The Colorado Privacy Act provides consumers with privacy rights, such as:

• The right to opt-out from the sale personal information, or the use of personal information for advertising. 
• The right to know whether personal data is collected
• The right to see what personal data is collected, and the right to correct and delete that data
• The right to download personal data for transfer

The Act applies to companies that operate in Colorado or target Colorado residents in a major way. The threshold is collecting information on 100,000 or more people or selling personal data on 25,000 or more people.

Companies subject to the law must obtain consent from consumers before collecting or using sensitive personal information, including data on children, genetic or biometric information and information about race, ethnicity, religion, health, sex or citizenship.