The Colorado Privacy Act rules, or “CPA rules,” are the guiding pillars of data protection in Colorado.
Like other US data protection laws, the Colorado Privacy Act protects the digital privacy of its residents by establishing rules about how companies can responsibly handle their personal data.
In this article, we’ll go over the key components of the CPA, including what the law is, which businesses must comply, how to comply, the penalties for non-compliance, and more.
Let’s dive in!
Key Takeaway
The CPA is a data protection law with far-reaching implications for medium to large businesses operating in Colorado or handling the personal data of its residents.
Coloradans have new rights and controls over their personal data thanks to the CPA. On the other hand, businesses must observe several requirements to protect consumers’ data and operate ethically in a privacy-centric society.
Non-compliance with CPA rules is considered a deceptive trade practice under the Colorado Consumer Protection Act. It attracts fines ranging from $2,000 to $20,000 per violation and, in extreme cases, criminal charges.
What is the Colorado Privacy Act?
What is the Colorado Privacy Act (2).jpg
The Colorado Privacy Act (CPA) is a comprehensive data privacy law that was passed in July 2021 and went into effect on July 1, 2023.
It grants Colorado residents more control over their personal data by having businesses be transparent and accountable for collecting and handling such data.
For clarity’s sake, personal data under the CPA is any information that can be reasonably linked to a natural person. Examples include names, email addresses, phone numbers, social security numbers, identification numbers, etc.
Note: Personal data doesn’t include publicly available information and “de-identified data” (i.e., data stripped of all personally identifying information).
The CPA contains many identical provisions to other US data privacy laws, including the California Consumer Privacy Act (CCPA) and the Virginia Consumer Data Protection Act (CDPA).
It also takes certain pages from the playbook of the renowned EU General Data Protection Regulation (GDPR).
Who Needs to Follow the Colorado Privacy Act?
Like the GDPR, Colorado’s law classifies businesses into data controllers and data processors based on their data processing functions.
Specifically, the law applies to data controllers and processors who:
Do business in the state of Colorado
Target Colorado’s residents to sell products or services, and
Meet at least one of the following criteria:
Annually controls or processes the personal data of at least 100,000 consumers
Gains revenue or receives discounts from selling personal data and controls or processes the data of at least 25,000 consumers
Note that “consumers” under the CPA refers to Colorado residents acting in the individual or household context — not the employment or business-to-business (B2B) context.
In other words, the CPA only covers the data of actual consumers, not workforce individuals (e.g., job applicants, employees, etc.).
Exemptions to the Colorado Privacy Act Rules
Unlike other US state laws, the CPA doesn’t exempt nonprofits from its scope. That said, the law excludes a long list of organizations and personal data from its coverage.
Briefly, the CPA exemptions are as follows:
Financial institutions subject to the Gramm-Leach-Bliley Act (GBLA)
Personal data maintained in compliance with the following federal laws:
Health Insurance Portability and Accountability Act (HIPAA)
Family Educational Rights and Privacy Act (FERPA)
Children’s Online Privacy Protection Act (COPPA)
Fair Credit Reporting Act (FCRA)
Air carries
Public utilities
Higher education institutions
Consumer reporting agencies
National securities associations
Governmental organizations in Colorado
Organizations handling “de-identified” personal data
Organizations handling data for employment records purposes
Organizations processing data for Colorado health insurance law
Colorado Privacy Act Rights
Colorado Privacy Act Rights.png
Like other US privacy laws, the CPA gives consumers several rights over how their personal data is handled. The implication? Businesses must have systems in place to help exercise these requests promptly.
Let’s briefly go over consumer rights under the CPA:
Right to know and access
This right is notably two-part. First, consumers have the right to know if you collect or process their personal data. Upon their confirmation, consumers also have the right to access the data you hold about them.
Right to correct
The CPA gives consumers the right to correct any inaccurate or outdated details in the data your business holds about them.
Right to delete
Consumers have the right to request the deletion of their personal data from your records and databases. However, this right doesn’t apply in all circumstances.
For instance, if a legal obligation requires you to retain a consumer’s data, you can hold on to it despite the consumer’s request for deletion.
Right to opt out
While the CPA’s right to opt out isn’t so different from other laws, its standards are notably unique.
Under the law, consumers can opt out of data processing for purposes such as:
Targeted advertising
The sale of their data
Specific profiling activities
Starting July 1, 2024, businesses must support a “universal opt-out mechanism,” which allows consumers to exercise all opt-out rights at the click of a button.
Colorado’s attorney general will announce the technical standards of the universal opt-out mechanism on or before this date.
Right to data portability
Finally, consumers have the right to obtain a copy of their personal data in a portable and readily usable format. They can then transfer this data to a third party without any hindrance.
Colorado Privacy Act Rules
Colorado Privacy Act Rules.png
As mentioned, the CPA includes many similar requirements as other US state data privacy laws. In other words, businesses that already comply with laws like California’s CPRA and Virginia’s CDPA have less to do to comply with the CPA.
That said, the CPA does introduce some unique features to data protection. Let’s take a look.
Conduct data protection assessments
One of the most important compliance steps under the CPA is conducting regular data protection assessments. These assessments help evaluate your business’s standing with the law and pinpoint compliance gaps to address.
Under the CPA, data protection assessments are especially important for activities that may present a heightened risk to consumers, such as data sales, target advertising, processing sensitive personal information, etc.
Observe CPA consent standards
Consent isn’t always required under the CPA. In fact, there are only a few cases where your business needs consumers’ consent, including:
Processing sensitive personal information
From the guardian if collecting and processing the personal data of children under 13
Processing data for other purposes beyond what you originally established with consumers
In cases where you do need consent, the CPA standards are as strict as the GDPR’s. In other words, consent must be freely given, specific, informed, unambiguous, and have an affirmative action.
Maintain a transparent privacy policy
Another critical compliance requirement is to maintain a clear and easily accessible privacy policy. If you already have a privacy policy, you may need to update it to fit the CPA’s requirements.
Specifically, your privacy policy must, at minimum, include the following:
What personal and sensitive data you collect
Your purposes for collecting data
Who you share personal data with
CPA consumer rights and how to exercise them
Your contact information
Respond promptly to DSARs
When a consumer requests access to their data (verbally or in writing), it’s known as a Data Subject Access Request (DSAR). DSARs are also generally used to describe requests for data correction, deletion, and opt-outs.
In any case, the CPA gives businesses 45 days to respond to a consumer’s request after receiving it. If the request is complex, you can delay your response by an additional 45 days, but you must notify consumers about this delay within the first 45 days and the reasons for it.
Maintain adequate data security measures
In an era of constant data breaches and other cyber crimes, maintaining effective data security measures has never been more critical — and the CPA echoes this sentiment.
Practically speaking, encrypting data, regularly updating security software, and limiting data access are some of the most effective ways to secure data.
Conduct employee training
Your employees are your first line of defense against data breaches, cyber-attacks, and non-compliance. As such, they need to be properly educated about the importance of CPA compliance and their role in your corporate compliance program.
Partner with Captain Compliance
Finally, consider engaging a compliance service like Captain Compliance to help you navigate the complexities of the CPA.
Why should you? Picture a reliable compliance provider with all the tools, software, and insights you need to streamline your compliance efforts with ease.
Leveraging Captain Compliance guarantees a smooth data privacy journey, freeing you up to focus on your core business goals.
Colorado Privacy Act Enforcement
The CPA doesn’t grant consumers a private right of action. This means a Colorado resident cannot file a private lawsuit against non-compliant businesses.
Instead, CPA enforcement rests in the hands of Colorado’s Attorney General and its district attorneys.
Before enforcement, the Attorney General or district attorneys will issue a notice of violation to non-compliant businesses, giving them a 60-day “cure period” to rectify any violation.
However, the 60-day cure period is only effective for 18 months after the CPA takes effect. Starting January 1, 2025, the cure period will no longer apply.
Penalties for Non-Compliance with the Colorado Privacy Act
Interestingly, the CPA text doesn’t specify any penalties for violations. Instead, the law considers CPA violations a deceptive trade practice under the Colorado Consumer Protection Act.
As a result, CPA penalties range from $2,000 to $20,000 per violation, with a maximum fine of $500,000. Moreover, severe violations under the CPA may lead to criminal charges.
Next Steps
By reading through the intricacies of the CPA, you’ve taken the first step toward achieving compliance. Now, it’s time for execution. And that’s where Captain Compliance comes in.
We understand how challenging compliance can be, so our mission is to simplify this process and take the burden off your hands.
Our suite of specialized software and services is designed to help your business achieve compliance with confidence.
A few of the features we offer include:
Comprehensive data protection assessments
Drafting compliant privacy policies
Efficient DSAR implementation
Ongoing guidance
And more!
Ready to achieve CPA compliance with ease? Get in touch today!
FAQs
Does the CPA apply to businesses outside of Colorado?
Yes, the CPA can apply to businesses outside of Colorado if they offer goods and services to Colorado’s residents and meet specific criteria like processing over 100,000 Coloradan personal information.
In other words, your business’s physical location isn’t a relevant factor when it comes to the CPA’s scope.
See also: Who does the CPRA apply to?
How can I achieve CPA compliance?
Achieving CPA compliance means meeting the requirements of the law. This includes but isn’t limited to the following:
Conducting employee training
Implementing robust security measures
Performing regular data protection assessments
Establishing processes to handle DSARs promptly
Partnering with a reputable compliance service for effective results
Learn more in our Data Protection Compliance Services Guide
What rights do Colorado residents have under the CPA?
Colorado residents have the right to access their personal data, request corrections and deletions, opt out of data processing for specific purposes, and obtain their data in a portable format for transfer to a third party.
See also: CPRA’s right to deletion
Does the CPA require a privacy policy?
Yes, it does. Under the CPA, your privacy policy must be transparent and easily accessible. It should outline how you handle consumer data, including the purposes for data collection, consumer rights, and how individuals can exercise those rights.