How to navigate the new Colorado Privacy Act (CPA)
The Colorado Privacy Act (CPA) passed yesterday in the state's senate and will go into effect in July 2023 – creating an additional regulation that organizations must comply with or face hefty fines and eroding consumer trust. Colorado is the third state to enact a cross-industry privacy law, following following Virginia’s Consumer Data Protection Act (CDPA) and the California Consumer Privacy Act (CCPA).
As noted by JD Supra, the CPA will be enforced by the attorney general or district attorneys. There is not a private right of action, but violations do constitute a deceptive trade practice, and penalty amounts are up to $2,000 per violation with a maximum of $500,000 for related violations.