On December 5, 2024, the Colorado Department of Law (Department) adopted an amended draft of its latest proposed Colorado Privacy Act (CPA) regulations. This set of amended regulations follows a public comment period that concluded with a public hearing held on November 7, 2024. The Department has also provided a cover letter explaining how the regulations were revised based on feedback received during the comment period.

In Depth

As a refresher, the proposed regulations:

1. Require any controller (including employers) that collects biometrics to give a pre-collection notice to the data subject;
2. Impose new biometrics collection obligations on employers;
3. Require controllers to obtain consent to process the personal data of minors (consumers under age 18); and
4. Introduce methods by which companies can seek regulatory guidance from the Colorado attorney general (AG).

The amended regulations introduce some implementation-friendly clarifications, including providing that:

• A controller’s biometric notice may be included in its general privacy notice;
• Consent is only required when processing the personal data of a consumer whom the controller “actually knows or willfully disregards” is a minor;
• Employers are only required to “refresh” consent to collect biometrics in certain limited scenarios; and
• Submitting a data protection assessment when seeking an opinion letter from the AG does not constitute a waiver of attorney-client privilege, and assessments required under the CPA are exempt from public inspection under the Colorado Open Records Act.

As the final step in the rulemaking process, the Department has requested a formal opinion on the amended regulations from the AG. The regulations will be filed with the Colorado secretary of state after a formal opinion is issued, and the regulations will become effective 30 days after they are published in the state register. Given the short runway after the regulations are published, businesses subject to the CPA should begin preparing to comply with the newly adopted draft of the CPA regulations.