What happened?

On December 6, 2024, the Colorado Attorney General announced updates to the Colorado Privacy Act (CPA) rules. These rules were filed with the Secretary of State and the Office of Legislative Legal Service on December 17, 2024.

Overview:

The updated Colorado Privacy Act (CPA) introduces new obligations for (1) biometric data and (2) children’s privacy and (3) allows businesses to seek opinion letters and interpretive guidance from the Attorney General.  

• These changes, modified by the attorney general’s office to address amendments passed during the 2024 legislative session, aim to enhance transparency and protection for individuals’ data in Colorado. 
• Data Controllers must inform individuals about the data collected, its purpose, retention period, and sharing practices.  
• Parental or guardian consent is required before processing a minor’s data. 
• The Colorado Attorney General and district attorneys may enforce violations of the updated rules. 

Additional Details:

1. Biometric Data: Effective July 1, 2025, entities collecting biometric data (such as fingerprints, voiceprints, retina or iris scans, facial mapping, etc.) must adhere to stringent notice and consent requirements. 

• Employers must obtain written or electronic consent from employees before collecting their biometric data. 
• Fresh consent is required for new purposes or additional types of biometric identifiers. 

2. Children’s Privacy Protections: Effective October 1, 2025, entities offering online services, products, or features to minors must: 

• Obtain parental or guardian consent before processing a minor’s data. 
• Conduct data protection assessments for features designed to increase minors’ use. 
• Limit data retention duration and avoid manipulative design features. 

3. Opinion Letters and Interpretive Guidance: Effective 30 days after being Published in the Federal Register, Businesses can request opinion letters and interpretive guidance from the Attorney General to clarify CPA compliance obligations.  

• These letters can provide a “good faith reliance defense” even for non-requesting entities, at the Attorney General’s discretion.  
• Data protection assessments submitted with requests retain confidentiality and do not waive any legal privilege or work product protection.  
• Opinion letters will be published with redacted information as the Colorado Open Records Act requires. 
• They have not been published in the federal register at the time of writing this article.  

Source References

• CPA Resources
• CPA Rules
• CPA Rules Redline
• Colorado Amends the Colorado Privacy Act to Enhance Protections for Minors (VensureHR)
• Colorado Proposes Amendments to the Colorado Privacy Act Rules (VensureHR)

This communication is intended solely for the purpose of conveying information. The present post might incorporate hyperlinks directing readers to websites managed by third-party entities. The inclusion of any links within this communication is meant to serve as points of reference and could encompass opinion articles from various law firms, articles from HR associations, official websites, news releases, and documents of government agencies, and other relevant third-party sources. Vensure has no authority over these external websites and bears no responsibility for their content. Furthermore, Vensure does not endorse the materials present on these websites. The contents of this communication should not be interpreted as legal advice or as a legal standpoint concerning specific facts or scenarios. Nor should it be deemed an exhaustive compilation of facts potentially pertinent to federal, state, or local laws. It is strongly advised that employers solicit legal guidance from an employment attorney when undertaking actions in response to any legal updates provided. This is due to the possibility of future alterations occurring in federal, state, and local laws, regulations, as well as the directives and guidelines issued by governing agencies. These changes may transpire at any given time, potentially rendering certain portions of the content within this update void or inaccurate.