Law / United States / 
Colorado
Colorado Privacy Act Rules (Attorney General)
In force since .
A comprehensive regime rule binding private bodies.
- Obligation class
- Data subject rights, Consent, Disclosure, DPIA, Biometric, Retention, Security
As of .
What it requires
- Treat an opt-out request received through a Universal Opt-Out Mechanism as a valid request to opt out of targeted advertising, the sale of personal data, or both, and be capable of recognizing each mechanism on the Department of Law's public list once you have had at least six months' notice of it (Rule 5.08).
- Give a biometric identifier notice at or before the initial collection or processing of any biometric identifier, or before a material change to the processing purpose (Rule 6.12).
- Keep records of consumer data rights requests, your responses and the basis for any denial for at least 24 months (Rule 6.11).
- Conduct and document a data protection assessment before starting processing that presents a heightened risk of harm, and review and update it as often as appropriate (Rule 8.05).
- Honor a consumer's request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects where the profiling rests on solely automated processing or human reviewed automated processing (Rule 9.04).
- Process personal data with reasonable and appropriate administrative, technical, organizational and physical safeguards (Rule 6.09).
- Require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits, with consent meeting Rules 7.03 to 7.08 (Rule 7.09).
These lines are LexLint's reading of the law's text, as of .
What this law does
The Colorado Privacy Act Rules, 4 CCR 904-3, are the Attorney General's implementation and operational guidelines for the Colorado Privacy Act. The rules took effect on , with amendments effective and, for Rules 2.02, 6.13, 6.14 and 7.03 B.3, . A controller that receives an opt-out request through a Universal Opt-Out Mechanism must treat it as a valid request to opt out of targeted advertising, the sale of personal data, or both.
A controller must keep records of consumer data rights requests for at least 24 months. A controller must give any required biometric identifier notice at or before the initial collection or processing of a biometric identifier. A controller must conduct and document a data protection assessment before it starts a processing activity that presents a heightened risk of harm to a consumer.
A request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects must be honored where the profiling rests on solely automated processing or human reviewed automated processing. Personal data must be processed with reasonable and appropriate administrative, technical, organizational and physical safeguards.
An employer may require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits.
When LexLint raises it
When your app profile says your app crawls the web, trains models, deploys a chatbot, sends automated outreach, makes high-risk automated decisions, processes voice recordings or processes biometric data.