What Businesses Need to Know About the Colorado Privacy Act

Akin Gump published a client alert about the passage of the Colorado Privacy Act (CPA). Colorado is the third state to enact a comprehensive consumer data privacy law, following California and Virginia. Corporations that do business in Colorado will have two years to evaluate their data privacy practices and ensure they are prepared to comply with the CPA, which goes into effect on July 1, 2023. The CPA does not feature groundbreaking privacy obligations, certain provisions do stand out. For instance, the law does not impose a revenue threshold, thus potentially subjecting small businesses who collect or profit from large amounts of personal data to comprehensive privacy obligations. Although the CPA does not take effect until July 1, 2023, businesses should act now to determine their compliance obligations, including by performing a comprehensive data inventory, reviewing and updating internal policies, and reviewing their contracts with vendors and other service providers. To read the full client alert, please click here.