Colorado Privacy Act (SB 21-190) Summary

• Establishes the Colorado Privacy Act giving Colorado residents rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, data sales, and profiling activities.

• Applies to businesses processing personal data of 100,000+ Colorado residents annually or deriving revenue from selling personal data of 25,000+ residents; excludes health information and other federally-regulated data.

• Requires data controllers to provide privacy notices, minimize data collection, specify processing purposes, secure personal data, obtain consent for sensitive data processing, and conduct data protection assessments for high-risk activities.

• Establishes Attorney General and district attorneys as sole enforcers with authority to seek injunctions and civil penalties; violations treated as deceptive trade practices with no private right of action.

• Effective July 1, 2023; includes implementation deadlines for Attorney General to establish universal opt-out mechanisms by July 1, 2024, and good faith reliance framework by July 1, 2025.