Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA) is a new law that went into effect on July 1, 2023. The CPA governs how businesses collect, use and disclose personal information about Coloradans.

The CPA was passed as part of what is known as the Colorado Consumer Protection Act (CCPA). The CCPA was passed in response to growing concerns about the protection of consumer data privacy in the digital age.

The CPA replaces the federal Electronic Communication Privacy Act (ECPA) which only applied to telecommunications providers and Internet service providers (ISPs). The ECPA did not apply to other categories of businesses that collect personal information such as retailers, banks, credit card companies and online services like Facebook or Google.

Under the CPA:

• Consumers have the right to know what data businesses collect about them and how they use it;
• Consumers have a right to access any personal data held by a business about them;
• Consumers can request corrections of inaccurate data held by a business; and
• Consumers can request information be removed from a company's databases altogether if they believe there is no legitimate reason for it to continue being stored by that company.