On February 28, 2023, the Colorado Office of the Attorney General announced that revised draft Colorado Privacy Act (“CPA”) rules were adopted for review by the Colorado Attorney General prior to finalization and publication in the Colorado Register.

The revised rules are not final, and, as drafted, will take effect on July 1, 2023. The revised draft rules follow prior drafts dated October 10, 2022, December 21, 2022, and January 27, 2023.

Notable changes in the revised draft rules as compared to the July 27, 2023 version include clarification regarding the exemptions that apply to the rules; updated definitions; changes to requirements relating to consumer rights requests; changes to requirements for controllers to specify the purposes for which personal data is collected; and changes to rules relating to refreshing, refusing or withdrawing consent.

Additional changes may be made to the CPA rules prior to finalization. The CPA will take effect on July 1, 2023.