Colorado Privacy Act Subjects Companies That Collect Customer Data To Significant New Regulations

Lindsey Tonsager and Alexandra Scott’s commentary was included in The Colorado Chamber of Commerce’s publication, The Sum & Substance, regarding the Colorado Privacy Act.

Lindsey predicts that, “Some companies will be in better positions than others,” noting that national and international firms are likely prepped by existing California and European regulations. “But for mid-sized Colorado businesses and even small-sized Colorado businesses that just eke over the threshold limits for data, they have some work to do.”

Alexandra explained that enforcement will be phased in. Until 2025, controllers notified by the AG’s office of violations will have 60 days to cure them before they are assessed with civil penalties that can reach as high as $20,000 per violation. There is no private right of action.