§ 6-1-1301. Short Title

[ Editor’s note: This section is effective July 1, 2023. ] The short title of this part 13 is the “Colorado Privacy Act”. Source: L. 2021: Entire part added, (SB 21-190), ch. 483, p. 3445, § 1, effective July 1, 2023.

§ 6-1-1302. Legislative Declaration

[ Editor’s note: This section is effective July 1, 2023.] The general assembly hereby: Finds that: The people of Colorado regard their privacy as a fundamental right and an essential element of their individual freedom; Colorado’s constitution explicitly provides the right to privacy under section 7 of article II, and fundamental privacy rights have long […]

§ 6-1-1303. Definitions

[ Editor’s note: This section is effective July 1, 2023. ] As used in this part 13, unless the context otherwise requires: “Affiliate” means a legal entity that controls, is controlled by, or is under common control with another legal entity. As used in this subsection (1), “control” means: Ownership of, control of, or power […]

§ 6-1-1304. Applicability of Part

[ Editor’s note: This section is effective July 1, 2023.] Except as specified in subsection (2) of this section, this part 13 applies to a controller that: Conducts business in Colorado or produces or delivers commercial products or services that are intentionally targeted to residents of Colorado; and Satisfies one or both of the following […]

§ 6-1-1305. Responsibility According to Role

[ Editor’s note: This section is effective July 1, 2023.] Controllers and processors shall meet their respective obligations established under this part 13. Processors shall adhere to the instructions of the controller and assist the controller to meet its obligations under this part 13. Taking into account the nature of processing and the information available […]

§ 6-1-1306. Consumer Personal Data Rights – Repeal

[ Editor’s note: This section is effective July 1, 2023.] Consumers may exercise the following rights by submitting a request using the methods specified by the controller in the privacy notice required under section 6-1-1308 (1)(a). The method must take into account the ways in which consumers normally interact with the controller, the need for […]

§ 6-1-1307. Processing De-Identified Data

[ Editor’s note: This section is effective July 1, 2023.] This part 13 does not require a controller or processor to do any of the following solely for purposes of complying with this part 13: Reidentify de-identified data; Comply with an authenticated consumer request to access, correct, delete, or provide personal data in a portable […]

§ 6-1-1308. Duties of Controllers

[ Editor’s note: This section is effective July 1, 2023.] Duty of transparency. (a) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes: The categories of personal data collected or processed by the controller or a processor; The purposes for which the categories of personal data are processed; […]

§ 6-1-1309. Data Protection Assessments – Attorney General Access and Evaluation – Definition

[ Editor’s note: This section is effective July 1, 2023.] A controller shall not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each of its processing activities that involve personal data acquired on or after July 1, 2023, that present a heightened […]

§ 6-1-1310. Liability

[ Editor’s note: This section is effective July 1, 2023.] Notwithstanding any provision in part 1 of this article 1, this part 13 does not authorize a private right of action for a violation of this part 13 or any other provision of law. This subsection (1) neither relieves any party from any duties or […]

§ 6-1-1311. Enforcement – Penalties – Repeal

[ Editor’s note: This section is effective July 1, 2023.] Notwithstanding any other provision of this article 1, the attorney general and district attorneys have exclusive authority to enforce this part 13 by bringing an action in the name of the state or as parens patriae on behalf of persons residing in the state to […]

§ 6-1-1312. Preemption – Local Governments

[ Editor’s note: This section is effective July 1, 2023. ] This part 13 supersedes and preempts laws, ordinances, resolutions, regulations, or the equivalent adopted by any statutory or home rule municipality, county, or city and county regarding the processing of personal data by controllers or processors. Source: L. 2021: Entire part added, (SB 21-190), […]

§ 6-1-1313. Rules – Opt-Out Mechanism

[ Editor’s note: This section is effective July 1, 2023.] The attorney general may promulgate rules for the purpose of carrying out this part 13. By July 1, 2023, the attorney general shall adopt rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer’s affirmative, freely given, […]