On December 21, 2022, the Colorado Attorney General published an updated version of the draft rules to the Colorado Privacy Act (“CPA”). The draft, which follows the first iteration of the proposed rules published on October 10, 2022, solicits comments on five topics: (1) new and revised definitions; (2) the use of IP addresses to verify consumer requests; (3) a proposed universal opt-out mechanism; (4) streamlining the privacy policy requirements; and (5) bona fide loyalty programs.

Notable changes in the second version of the draft CPA rules include updated definitions, removing the requirement that privacy notices be purpose-based, changing data protection assessment requirements, and relaxing conditions on when businesses have to seek refreshed consumer consent.

Stakeholders can submit comments to the second draft until January 18, 2023. The CPA will take effect on July 1, 2023.