In 2022 and 2023, several U.S. states enacted comprehensive state privacy laws. Two of these – the Colorado Privacy Act (“CPA”) and Connecticut’s Act Concerning Personal Data Privacy and Online Monitoring (the “Connecticut Data Privacy Act” or “CTDPA”) – will come into effect on July 1, 2023. Both laws provide state residents with certain rights over the collection and use of their data and require business to provide consumers with specific notices. Click here to read Willkie’s overview and analysis of the CTDPA.
In March 2023, Colorado finalized and published rules to implement the CPA, which enables Colorado residents to protect their personal data by enabling them to opt out of having their personal data processed by companies for targeted advertising, the sale of personal data, and certain types of profiling, in addition to the access, correction and deletion rights similar to the consumer rights provided for in other state comprehensive privacy laws. In addition, the CPA requires that businesses implement a universal opt-out mechanism, which must be in place by July 1, 2024.
Subject to certain exclusions, the CPA applies to entities that conduct business in Colorado or deliver commercial products or services to its residents, including nonprofits, that either 1) process personal data of more than 100,000 individuals per calendar year or 2) derive revenue or receive discounted good or services in exchange for the sale of personal data of 25,000 individuals or more. The CPA also applies to these companies’ service providers, contractors, and vendors that manage, maintain or provide related services. The CPA is enforceable by either the Colorado Attorney General’s Office or by District Attorneys.
For more information on other state privacy laws, please find our analysis of California’s privacy law here and here, and our 2022 Privacy Day publication here. To address the complexities facing the insurance industry, we also offer a snapshot of how new state privacy laws will affect that industry’s approach to compliance, here.