2024 Colorado Privacy Act Provision Updates

The Colorado Privacy Act (CPA) went into effect on July 1, 2023, but there are a couple new provisions going into effect this year that businesses need to consider. 

• Starting on July 1, 2024, controllers and processors will be required to allow consumers to opt out using a Universal Opt-Out Mechanism, as defined by the Colorado Attorney General’s office.  
• Sensitive personal data collected before the CPA went into effect was given a 1-year grace period to obtain consent for processing. That grace period also expires on July 1, 2024. 
• At the beginning of next year, the 60-day cure period expires. This cure period is designed to give companies an opportunity to obtain consent before the attorney general can start proceedings for breach of the CPA.
• In April 2024, Governor Polis signed an amendment to the CPA expanding the definition of sensitive data to include biological and neural data to be used for the identification of an individual generated by technologically analyzing an individual’s biological; genetic; biochemical; physiological; or neural properties, compositions, or activities, or body or bodily functions.

Companies should evaluate whether their privacy policies incorporate these new provisions.

Subscribe HERE to receive more client advisories about AI, privacy, cybersecurity, and emerging technology issues.