Colorado Privacy Act (CPA)
The CPA protects the personal data of Colorado residents when they act in an individual or household context, for example when browsing the internet or signing up for a retail rewards program.
Is Complying with CPA Mandatory?
The law applies to entities, including nonprofits, that conduct business in Colorado or deliver commercial products or services targeted to residents of Colorado; AND either:
Process the personal data of more than 100,000 individuals in any calendar year; or
Derive revenue or receive discounts on goods or services in exchange for the sale of personal data of 25,000 or more individuals.
The law also applies to service providers, contractors, and vendors that manage, maintain, or provide services relating to the data on behalf of these companies.
What are the penalties for not complying with CPA?
The Attorney General’s Office and District Attorneys have sole enforcement power under the CPA. The Attorney General’s Office also has rulemaking authority under the law.