Colorado Privacy Act (SB 21-190; C.R.S. 6-1-1301 et seq.) and Attorney General rules (4 CCR 904-3, Part 9): profiling opt-out and data protection assessments

Summary

Colorado's comprehensive consumer privacy law (SB 21-190), in force since July 1, 2023, applies to entities doing business in Colorado or targeting its residents that control or process the personal data of at least 100,000 consumers a year, or that earn revenue from selling personal data and handle data of at least 25,000 consumers. Consumers may opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. Controllers must conduct a data protection assessment before processing that presents a heightened risk of harm, which includes profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial or physical injury. The Attorney General's rules (4 CCR 904-3), also effective July 1, 2023, add a Part 9 on profiling, which the Attorney General described as the first state regulation of automated decision-making within a general privacy law. Under Rule 9.04, opt-out requests must be honored for profiling based on solely automated or human-reviewed automated processing; a controller may decline the request where the profiling uses human-involved automated processing, and must then tell the consumer. The act exempts financial institutions and their affiliates subject to the Gramm-Leach-Bliley Act at the entity level, as well as GLBA- and FCRA-covered data. Violations are deceptive trade practices enforced only by the Attorney General and district attorneys; there is no private right of action. The 60-day cure period expired on January 1, 2025.

Key dates

1. July 7, 2021Enacted
2. 2023-07-01 (act and rules)Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. THE SHORT TITLE OF THIS PART 13 IS THE "COLORADO PRIVACY ACT".

   Supports: Name and statutory location

   This act takes effect July 1, 2023

   Supports: Effective date

   (C) PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER.

   Supports: Profiling opt-out

   PROCESSING PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR FOR PROFILING IF THE PROFILING PRESENTS A REASONABLY FORESEEABLE RISK OF: (I) UNFAIR OR DECEPTIVE TREATMENT OF, OR UNLAWFUL DISPARATE IMPACT ON, CONSUMERS; (II) FINANCIAL OR PHYSICAL INJURY TO CONSUMERS

   Supports: Data protection assessment for risky profiling

   A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION AS DEFINED BY AND THAT IS SUBJECT TO THE FEDERAL "GRAMM-LEACH-BLILEY ACT"

   Supports: Entity-level GLBA exemption

   FOR PURPOSES ONLY OF ENFORCEMENT OF THIS PART 13 BY THE ATTORNEY GENERAL OR A DISTRICT ATTORNEY, A VIOLATION OF THIS PART 13 IS A DECEPTIVE TRADE PRACTICE.

   Supports: Enforcement

   THIS PART 13 DOES NOT AUTHORIZE A PRIVATE RIGHT OF ACTION FOR A VIOLATION OF THIS PART 13 OR ANY OTHER PROVISION OF LAW.

   Supports: No private right of action

   IF THE CONTROLLER FAILS TO CURE THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF THE NOTICE OF VIOLATION, AN ACTION MAY BE BROUGHT PURSUANT TO THIS SECTION. THIS SUBSECTION (1)(d) IS REPEALED, EFFECTIVE JANUARY 1, 2025.

   Supports: Cure period and its expiry

   Senate Bill 21-190, Signed Act (Colorado Privacy Act) Colorado General Assembly Primary source

2. 07/07/2021 Governor Governor Signed

   Supports: Signing date

   Control or process personal data of at least 100,000 consumers per calendar year

   Supports: Applicability threshold (enacted-bill summary)

   SB21-190 Protect Personal Data Privacy (bill page) Colorado General Assembly Primary source

3. they will go into effect July 1, 2023

   Supports: Rules effective date

   Colorado is the first state in the country to enact regulations governing automated decision making (i.e., profiling) in the context of a general state privacy law.

   Supports: Part 9 profiling rules

   Attorney General's Office files finalized Colorado Privacy Act rules (15 March 2023) Colorado Department of Law (Attorney General) Primary source

4. based on Solely Automated Processing or Human Reviewed Automated Processing shall be honored

   Supports: Rule 9.04: opt-out honored for solely automated and human-reviewed profiling

   A Controller may decide not to take action on a request to opt out of Profiling in furtherance of Decisions that Produce Legal or other Similarly Significant Effects Concerning a Consumer if the Profiling used is based on Human Involved Automated Processing.

   Supports: Rule 9.04: human-involved processing exception

   Colorado Privacy Act Rules, 4 CCR 904-3 (final rules filed 15 March 2023) Colorado Department of Law (Attorney General) Primary source