Colorado AG’s Office Finalizes Colorado Privacy Act Rules

Last week the Colorado Attorney General’s Office finalized rules implementing the Colorado Privacy Act after a months-long, iterative rulemaking process. The rules address various areas of the law such as consumer personal data rights, universal opt-out mechanisms, bona fide loyalty programs, and various duties of controllers, including a duty of care. EPIC submitted comments to strengthen consumer privacy in August 2022 and January 2023 as the rulemaking process progressed.