iThe Colorado Privacy Act (CPA) and the Connecticut Data Privacy Act (CTDPA) take effect on July 1, 2023. The CPA regulations take effect at the same time. And if you are subject to California’s laws, this is the enforcement date for California Consumer Privacy Act, as amended by California Privacy Rights Act.
Whether you are just now in the reach of US state privacy laws under the Colorado or Connecticut thresholds or you have an existing US privacy program for California or Virginia laws, you may need to take affirmative steps prior to July 1. The states do not converge on all topics, so existing programs may need updates. For example, the CPA regulations include topics not addressed in the current California privacy regulations such as data protection impact assessments and more discussion of loyalty programs. Consider also if your privacy statements need updates to speak to Colorado and Connecticut consumers about their data rights and your response processes are ready to respond to Colorado and Connecticut consumer requests.
