SENATE BILL 21-190

BY SENATOR(S) Rodriguez and Lundeen, Bridges, Buckner, Coleman,
Cooke, Danielson, Donovan, Fenberg, Gardner, Ginal, Gonzales, Hansen,
Hisey, Holbert, Jaquez Lewis, Kirkmeyer, Kolker, Lee, Liston, Moreno,
Pettersen, Priola, Rankin, Scott, Simpson, Sonnenberg, Story, Winter,
Woodward, Garcia;
also REPRESENTATIVE(S) Duran and Carver, Bernett, Bird, Cutter,
Exum, Gonzales-Gutierrez, Gray, Herod, Jodeh, Lynch, McCluskie,
McCormick, Mullica, Ricks, Snyder, Titone, Valdez A., Woodrow.

CONCERNING ADDITIONAL PROTECTION OF DATA RELATING TO PERSONALPRIVACY.

Be it enacted by the General Assembly of the State of Colorado:
SECTION 1. In Colorado Revised Statutes, add part 13 to article
1 of title 6 as follows:
PART 13COLORADO PRIVACY ACT
6-1-1301. Short title. THE SHORT TITLE OF THIS PART 13 IS THE"COLORADO PRIVACY ACT".

Capital letters or bold & italic numbers indicate new material added to existing law; dashes
through words or numbers indicate deletions from existing law and such material is not part of
the act.

6-1-1302. Legislative declaration. (1) THE GENERAL ASSEMBLY
HEREBY:(a) FINDS THAT:(I) THE PEOPLE OF COLORADO REGARD THEIR PRIVACY AS A
FUNDAMENTAL RIGHT AND AN ESSENTIAL ELEMENT OF THEIR INDIVIDUAL
FREEDOM;(II) COLORADO'S CONSTITUTION EXPLICITLY PROVIDES THE RIGHT TOPRIVACY UNDER SECTION 7 OF ARTICLE II, AND FUNDAMENTAL PRIVACYRIGHTS HAVE LONG BEEN, AND CONTINUE TO BE, INTEGRAL TO PROTECTING
COLORADANS AND TO SAFEGUARDING OUR DEMOCRATIC REPUBLIC;(III) ONGOING ADVANCES IN TECHNOLOGY HAVE PRODUCEDEXPONENTIAL GROWTH IN THE VOLUME AND VARIETY OF PERSONAL DATABEING GENERATED, COLLECTED, STORED, AND ANALYZED AND THESE
ADVANCES PRESENT BOTH PROMISE AND POTENTIAL PERIL;(IV) THE ABILITY TO HARNESS AND USE DATA IN POSITIVE WAYS ISDRIVING INNOVATION AND BRINGS BENEFICIAL TECHNOLOGIES TO SOCIETY,
BUT IT HAS ALSO CREATED RISKS TO PRIVACY AND FREEDOM; AND(V) THE UNAUTHORIZED DISCLOSURE OF PERSONAL INFORMATION
AND LOSS OF PRIVACY CAN HAVE DEVASTATING IMPACTS RANGING FROMFINANCIAL FRAUD, IDENTITY THEFT, AND UNNECESSARY COSTS IN PERSONALTIME AND FINANCES TO DESTRUCTION OF PROPERTY, HARASSMENT,REPUTATIONAL DAMAGE, EMOTIONAL DISTRESS, AND PHYSICAL HARM;(b) DETERMINES THAT:(I) TECHNOLOGICAL INNOVATION AND NEW USES OF DATA CAN HELPSOLVE SOCIETAL PROBLEMS AND IMPROVE LIVES, AND IT IS POSSIBLE TO
BUILD A WORLD WHERE TECHNOLOGICAL INNOVATION AND PRIVACY CANCOEXIST; AND(II) STATES ACROSS THE UNITED STATES ARE LOOKING TO THIS PART
13 AND SIMILAR MODELS TO ENACT STATE-BASED DATA PRIVACYREQUIREMENTS AND TO EXERCISE THE LEADERSHIP THAT IS LACKING AT THE
PAGE 2-SENATE BILL 21-190

NATIONAL LEVEL; AND(c) DECLARES THAT:(I) BY ENACTING THIS PART 13, COLORADO WILL BE AMONG THE
STATES THAT EMPOWER CONSUMERS TO PROTECT THEIR PRIVACY AND
REQUIRE COMPANIES TO BE RESPONSIBLE CUSTODIANS OF DATA AS THEYCONTINUE TO INNOVATE;(II) THIS PART 13 ADDRESSES ISSUES OF STATEWIDE CONCERN AND:(A) PROVIDES CONSUMERS THE RIGHT TO ACCESS, CORRECT, AND
DELETE PERSONAL DATA AND THE RIGHT TO OPT OUT NOT ONLY OF THE SALE
OF PERSONAL DATA BUT ALSO OF THE COLLECTION AND USE OF PERSONALDATA;(B) IMPOSES AN AFFIRMATIVE OBLIGATION UPON COMPANIES TO
SAFEGUARD PERSONAL DATA; TO PROVIDE CLEAR, UNDERSTANDABLE, AND
TRANSPARENT INFORMATION TO CONSUMERS ABOUT HOW THEIR PERSONALDATA ARE USED; AND TO STRENGTHEN COMPLIANCE AND ACCOUNTABILITYBY REQUIRING DATA PROTECTION ASSESSMENTS IN THE COLLECTION AND USE
OF PERSONAL DATA; AND(C) EMPOWERS THE ATTORNEY GENERAL AND DISTRICT ATTORNEYS
TO ACCESS AND EVALUATE A COMPANY'S DATA PROTECTION ASSESSMENTS,
TO IMPOSE PENALTIES WHERE VIOLATIONS OCCUR, AND TO PREVENT FUTURE
VIOLATIONS.
6-1-1303. Definitions. AS USED IN THIS PART 13, UNLESS THE
CONTEXT OTHERWISE REQUIRES:(1) "AFFILIATE" MEANS A LEGAL ENTITY THAT CONTROLS, IS
CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER LEGALENTITY. AS USED IN THIS SUBSECTION (1), "CONTROL" MEANS:(a) OWNERSHIP OF, CONTROL OF, OR POWER TO VOTE TWENTY-FIVE

PERCENT OR MORE OF THE OUTSTANDING SHARES OF ANY CLASS OF VOTINGSECURITY OF THE ENTITY, DIRECTLY OR INDIRECTLY, OR ACTING THROUGHONE OR MORE OTHER PERSONS;PAGE 3-SENATE BILL 21-190

(b) CONTROL IN ANY MANNER OVER THE ELECTION OF A MAJORITY
OF THE DIRECTORS, TRUSTEES, OR GENERAL PARTNERS OF THE ENTITY OR OF
INDIVIDUALS EXERCISING SIMILAR FUNCTIONS; OR
THE POWER TO EXERCISE, DIRECTLY OR INDIRECTLY, A
CONTROLLING INFLUENCE OVER THE MANAGEMENT OR POLICIES OF THE
ENTITY AS DETERMINED BY THE APPLICABLE PRUDENTIAL REGULATOR, AS
THAT TERM IS DEFINED IN 12 U.S.C. SEC. 5481 (24), IF ANY.
(c)(2) "AUTHENTICATE" MEANS TO USE REASONABLE MEANS TO
DETERMINE THAT A REQUEST TO EXERCISE ANY OF THE RIGHTS IN SECTION
6-1-1306 (1) IS BEING MADE BY OR ON BEHALF OF THE CONSUMER WHO IS
ENTITLED TO EXERCISE THE RIGHTS.
(3) "BUSINESS ASSOCIATE" HAS THE MEANING ESTABLISHED IN 45
CFR 160.103.
(4) "CHILD" MEANS AN INDIVIDUAL UNDER THIRTEEN YEARS OF AGE.
(5) "CONSENT" MEANS A CLEAR, AFFIRMATIVE ACT SIGNIFYING A
CONSUMER'S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS
AGREEMENT, SUCH AS BY A WRITTEN STATEMENT, INCLUDING BY
ELECTRONIC MEANS, OR OTHER CLEAR, AFFIRMATIVE ACTION BY WHICH THE
CONSUMER SIGNIFIES AGREEMENT TO THE PROCESSING OF PERSONAL DATA.
THE FOLLOWING DOES NOT CONSTITUTE CONSENT:(a) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR SIMILAR

DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA PROCESSING
ALONG WITH OTHER, UNRELATED INFORMATION;(b) HOVERING OVER, MUTING, PAUSING, OR CLOSING A GIVEN PIECE
OF CONTENT; AND(c) AGREEMENT OBTAINED THROUGH DARK PATTERNS.

(6) "CONSUMER":(a) MEANS AN INDIVIDUAL WHO IS A COLORADO RESIDENT ACTINGONLY IN AN INDIVIDUAL OR HOUSEHOLD CONTEXT; AND

PAGE 4-SENATE BILL 21-190

(b) DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A COMMERCIAL OR
EMPLOYMENT CONTEXT, AS A JOB APPLICANT, OR AS A BENEFICIARY OF
SOMEONE ACTING IN AN EMPLOYMENT CONTEXT.
(7) "CONTROLLER" MEANS A PERSON THAT, ALONE OR JOINTLY WITH
OTHERS, DETERMINES THE PURPOSES FOR AND MEANS OF PROCESSINGPERSONAL DATA.
(8) "COVERED ENTITY" HAS THE MEANING ESTABLISHED IN 45 CFR
160.103.
(9) "DARK PATTERN" MEANS A USER INTERFACE DESIGNED OR
MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING OR
IMPAIRING USER AUTONOMY, DECISION-MAKING, OR CHOICE.
(10) "DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANTEFFECTS CONCERNING A CONSUMER" MEANS A DECISION THAT RESULTS IN
THE PROVISION OR DENIAL OF FINANCIAL OR LENDING SERVICES, HOUSING,
INSURANCE, EDUCATION ENROLLMENT OR OPPORTUNITY, CRIMINAL JUSTICE,EMPLOYMENT OPPORTUNITIES, HEALTH-CARE SERVICES, OR ACCESS TO
ESSENTIAL GOODS OR SERVICES.
(11)"DE-IDENTIFIED DATA" MEANS DATA THAT CANNOTREASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE
LINKED TO, AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL, OR A DEVICE
LINKED TO SUCH AN INDIVIDUAL, IF THE CONTROLLER THAT POSSESSES THE
DATA:(a) TAKES REASONABLE MEASURES TO ENSURE THAT THE DATACANNOT BE ASSOCIATED WITH AN INDIVIDUAL;(b) PUBLICLY COMMITS TO MAINTAIN AND USE THE DATA ONLY IN A
DE-IDENTIFIED FASHION AND NOT ATTEMPT TO RE-IDENTIFY THE DATA; AND(C)CONTRACTUALLY OBLIGATES ANY RECIPIENTS OF THE
INFORMATION TO COMPLY WITH THE REQUIREMENTS OF THIS SUBSECTION(11).
(12) "HEALTH-CARE FACILITY" MEANS ANY ENTITY THAT IS
LICENSED, CERTIFIED, OR OTHERWISE AUTHORIZED OR PERMITTED BY LAW
PAGE 5-SENATE BILL 21-190

TO ADMINISTER MEDICAL TREATMENT IN THIS STATE.
(13)"HEALTH-CARE INFORMATION" MEANS INDIVIDUALLY
IDENTIFIABLE INFORMATION RELATING TO THE PAST, PRESENT, OR FUTURE
HEALTH STATUS OF AN INDIVIDUAL.
(14) "HEALTH-CARE PROVIDER" MEANS A PERSON LICENSED,CERTIFIED, OR REGISTERED IN THIS STATE TO PRACTICE MEDICINE,
PHARMACY, CHIROPRACTIC, NURSING, PHYSICAL THERAPY, PODIATRY,DENTISTRY, OPTOMETRY, OCCUPATIONAL THERAPY, OR OTHER HEALINGARTS UNDER TITLE 12.
(15) "HIPAA" MEANS THE FEDERAL "HEALTH INSURANCEPORTABILITY AND ACCOUNTABILITY ACT OF 1996", AS AMENDED, 42 U.S.C.
SECS. 1320d TO 1320d-9.
(16) "IDENTIFIED OR IDENTIFIABLE INDIVIDUAL" MEANS AN
INDIVIDUAL WHO CAN BE READILY IDENTIFIED, DIRECTLY OR INDIRECTLY, IN
PARTICULAR BY REFERENCE TO AN IDENTIFIER SUCH AS A NAME, AN
IDENTIFICATION NUMBER, SPECIFIC GEOLOCATION DATA, OR AN ONLINEIDENTIFIER.
(17) "PERSONAL DATA":(a) MEANS INFORMATION THAT IS LINKED OR REASONABLY LINKABLE

TO AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL; AND(b) DOES NOT INCLUDE DE-IDENTIFIED DATA OR PUBLICLYAVAILABLE INFORMATION. AS USED IN THIS SUBSECTION (17)(b), "PUBLICLYAVAILABLE INFORMATION" MEANS INFORMATION THAT IS LAWFULLY MADEAVAILABLE FROM FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS AND
INFORMATION THAT A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE
THE CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC.
(18) "PROCESS" OR "PROCESSING" MEANS THE COLLECTION, USE,
SALE, STORAGE, DISCLOSURE, ANALYSIS, DELETION, OR MODIFICATION OFPERSONAL DATA AND INCLUDES THE ACTIONS OF A CONTROLLER DIRECTING
A PROCESSOR TO PROCESS PERSONAL DATA.
(19) "PROCESSOR" MEANS A PERSON THAT PROCESSES PERSONALPAGE 6-SENATE BILL 21-190

DATA ON BEHALF OF A CONTROLLER.
(20) "PROFILING" MEANS ANY FORM OF AUTOMATED PROCESSING OFPERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL ASPECTS
CONCERNING AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL'S ECONOMICSITUATION, HEALTH, PERSONAL PREFERENCES, INTERESTS, RELIABILITY,BEHAVIOR, LOCATION, OR MOVEMENTS.
(21) "PROTECTED HEALTH INFORMATION" HAS THE MEANINGESTABLISHED IN 45 CFR 160.103.
(22) "PSEUDONYMOUS DATA" MEANS PERSONAL DATA THAT CAN NO
LONGER BE ATTRIBUTED TO A SPECIFIC INDIVIDUAL WITHOUT THE USE OF
ADDITIONAL INFORMATION IF THE ADDITIONAL INFORMATION IS KEPTSEPARATELY AND IS SUBJECT TO TECHNICAL AND ORGANIZATIONAL
MEASURES TO ENSURE THAT THE PERSONAL DATA ARE NOT ATTRIBUTED TO
A SPECIFIC INDIVIDUAL.
(23) (a) "SALE", "SELL", OR "SOLD" MEANS THE EXCHANGE OFPERSONAL DATA FOR MONETARY OR OTHER VALUABLE CONSIDERATION BY
A CONTROLLER TO A THIRD PARTY.
(b) "SALE", "SELL", OR "SOLD" DOES NOT INCLUDE THE FOLLOWING:(I) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR THATPROCESSES THE PERSONAL DATA ON BEHALF OF A CONTROLLER;(II) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY FORPURPOSES OF PROVIDING A PRODUCT OR SERVICE REQUESTED BY THE
CONSUMER;(III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN
AFFILIATE OF THE CONTROLLER;(IV) THE DISCLOSURE OR TRANSFER TO A THIRD PARTY OF PERSONALDATA AS AN ASSET THAT IS PART OF A PROPOSED OR ACTUAL MERGER,ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION IN WHICH THE THIRDPARTY ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER'S ASSETS;
OR

PAGE 7-SENATE BILL 21-190

(V) THE DISCLOSURE OF PERSONAL DATA:(A) THAT A CONSUMER DIRECTS THE CONTROLLER TO DISCLOSE OR
INTENTIONALLY DISCLOSES BY USING THE CONTROLLER TO INTERACT WITH
A THIRD PARTY; OR(B) INTENTIONALLY MADE AVAILABLE BY A CONSUMER TO THE
GENERAL PUBLIC VIA A CHANNEL OF MASS MEDIA.
(24) "SENSITIVE DATA" MEANS:PERSONAL DATA REVEALING RACIAL OR ETHNIC ORIGIN,
RELIGIOUS BELIEFS, A MENTAL OR PHYSICAL HEALTH CONDITION OR
DIAGNOSIS, SEX LIFE OR SEXUAL ORIENTATION, OR CITIZENSHIP OR
CITIZENSHIP STATUS;(a)(b) GENETIC OR BIOMETRIC DATA THAT MAY BE PROCESSED FOR THE
PURPOSE OF UNIQUELY IDENTIFYING AN INDIVIDUAL; OR(c) PERSONAL DATA FROM A KNOWN CHILD.

(25) "TARGETED ADVERTISING":(a) MEANS DISPLAYING TO A CONSUMER AN ADVERTISEMENT THATIS SELECTED BASED ON PERSONAL DATA OBTAINED OR INFERRED OVER TIMEFROM THE CONSUMER'S ACTIVITIES ACROSS NONAFFILIATED WEBSITES,APPLICATIONS, OR ONLINE SERVICES TO PREDICT CONSUMER PREFERENCES
OR INTERESTS; AND(b) DOES NOT INCLUDE:(I) ADVERTISING TO A CONSUMER IN RESPONSE TO THE CONSUMER'S
REQUEST FOR INFORMATION OR FEEDBACK;(II) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A CONTROLLER'SOWN WEBSITES OR ONLINE APPLICATIONS;(III) ADVERTISEMENTS BASED ON THE CONTEXT OF A CONSUMER'S
CURRENT SEARCH QUERY, VISIT TO A WEBSITE, OR ONLINE APPLICATION; OR

PAGE 8-SENATE BILL 21-190

(IV) PROCESSING PERSONAL DATA SOLELY FOR MEASURING OR
REPORTING ADVERTISING PERFORMANCE, REACH, OR FREQUENCY.
(26) "THIRD PARTY" MEANS A PERSON, PUBLIC AUTHORITY, AGENCY,
OR BODY OTHER THAN A CONSUMER, CONTROLLER, PROCESSOR, OR
AFFILIATE OF THE PROCESSOR OR THE CONTROLLER.
6-1-1304. Applicability of part. (1) EXCEPT AS SPECIFIED IN
SUBSECTION (2) OF THIS SECTION, THIS PART 13 APPLIES TO A CONTROLLER
THAT:(a) CONDUCTS BUSINESS IN COLORADO OR PRODUCES OR DELIVERS

COMMERCIAL PRODUCTS OR SERVICES THAT ARE INTENTIONALLY TARGETEDTO RESIDENTS OF COLORADO; AND(b) SATISFIES ONE OR BOTH OF THE FOLLOWING THRESHOLDS:(I) CONTROLS OR PROCESSES THE PERSONAL DATA OF ONE HUNDRED
THOUSAND CONSUMERS OR MORE DURING A CALENDAR YEAR; OR(II) DERIVES REVENUE OR RECEIVES A DISCOUNT ON THE PRICE OFGOODS OR SERVICES FROM THE SALE OF PERSONAL DATA AND PROCESSES OR
CONTROLS THE PERSONAL DATA OF TWENTY-FIVE THOUSAND CONSUMERS OR
MORE.
(2) THIS PART 13 DOES NOT APPLY TO:(a) PROTECTED HEALTH INFORMATION THAT IS COLLECTED, STORED,AND PROCESSED BY A COVERED ENTITY OR ITS BUSINESS ASSOCIATES;(b) HEALTH-CARE INFORMATION THAT IS GOVERNED BY PART 8 OF
ARTICLE 1 OF TITLE 25 SOLELY FOR THE PURPOSE OF ACCESS TO MEDICALRECORDS;(c) PATIENT IDENTIFYING INFORMATION, AS DEFINED IN 42 CFR 2.11,

THAT ARE GOVERNED BY AND COLLECTED AND PROCESSED PURSUANT TO 42
CFR 2, ESTABLISHED PURSUANT TO 42 U.S.C. SEC. 290dd-2;(d) IDENTIFIABLE PRIVATE INFORMATION, AS DEFINED IN 45 CFR
46.102, FOR PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF
PAGE 9-SENATE BILL 21-190

HUMAN SUBJECTS PURSUANT TO 45 CFR 46; IDENTIFIABLE PRIVATEINFORMATION THAT IS COLLECTED AS PART OF HUMAN SUBJECTS RESEARCHPURSUANT TO THE ICH E6 GOOD CLINICAL PRACTICE GUIDELINE ISSUED BY
THE INTERNATIONAL COUNCIL FOR HARMONISATION OF TECHNICALREQUIREMENTS FOR PHARMACEUTICALS FOR HUMAN USE OR THE
PROTECTION OF HUMAN SUBJECTS UNDER 21 CFR 50 AND 56; OR PERSONALDATA USED OR SHARED IN RESEARCH CONDUCTED IN ACCORDANCE WITH ONE
OR MORE OF THE CATEGORIES SET FORTH IN THIS SUBSECTION (2)(d);(e) INFORMATION AND DOCUMENTS CREATED BY A COVERED ENTITY
FOR PURPOSES OF COMPLYING WITH HIPAA AND ITS IMPLEMENTINGREGULATIONS;(f) PATIENT SAFETY WORK PRODUCT, AS DEFINED IN 42 CFR 3.20,
THAT IS CREATED FOR PURPOSES OF PATIENT SAFETY IMPROVEMENTPURSUANT TO 42 CFR 3, ESTABLISHED PURSUANT TO 42 U.S.C. SECS.
299b-21 TO 299b-26;(g) INFORMATION THAT IS:(I) DE-IDENTIFIED IN ACCORDANCE WITH THE REQUIREMENTS FOR
DE-IDENTIFICATION SET FORTH IN 45 CFR 164; AND(II)
DERIVED FROM ANY OF THE HEALTH-CARE-RELATEDINFORMATION DESCRIBED IN THIS SECTION.
(h)
INFORMATION MAINTAINED IN THE SAME MANNER AS
INFORMATION UNDER SUBSECTIONS (2)(a) TO (2)(g) OF THIS SECTION BY:(I) A COVERED ENTITY OR BUSINESS ASSOCIATE;(II) A HEALTH-CARE FACILITY OR HEALTH-CARE PROVIDER; OR(III) A PROGRAM OF A QUALIFIED SERVICE ORGANIZATION AS
DEFINED IN 42 CFR 2.11;(i) (I) EXCEPT AS PROVIDED IN SUBSECTION (2)(i)(II) OF THISSECTION, AN ACTIVITY INVOLVING THE COLLECTION, MAINTENANCE,DISCLOSURE, SALE, COMMUNICATION, OR USE OF ANY PERSONAL DATABEARING ON A CONSUMER'S CREDITWORTHINESS, CREDIT STANDING, CREDIT
PAGE 10-SENATE BILL 21-190

CAPACITY, CHARACTER, GENERAL REPUTATION,
CHARACTERISTICS, OR MODE OF LIVING BY:PERSONAL(A) A CONSUMER REPORTING AGENCY AS DEFINED IN 15 U.S.C. SEC.
1681a (f);(B) A FURNISHER OF INFORMATION AS SET FORTH IN 15 U.S.C. SEC.
1681s-2 THAT PROVIDES INFORMATION FOR USE IN A CONSUMER REPORT, AS
DEFINED IN 15 U.S.C. SEC. 1681a (d); OR(C) A USER OF A CONSUMER REPORT AS SET FORTH IN 15 U.S.C. SEC.
1681b.
(II) THIS SUBSECTION (2)(i) APPLIES ONLY TO THE EXTENT THAT THE
ACTIVITY IS REGULATED BY THE FEDERAL "FAIR CREDIT REPORTING ACT",
15 U.S.C. SEC. 1681 ET SEQ., AS AMENDED, AND THE PERSONAL DATA ARENOT COLLECTED, MAINTAINED, DISCLOSED, SOLD, COMMUNICATED, OR USEDEXCEPT AS AUTHORIZED BY THE FEDERAL "FAIR CREDIT REPORTING ACT",AS AMENDED.
(j) PERSONAL DATA:(I) COLLECTED AND MAINTAINED FOR PURPOSES OF ARTICLE 22 OF
TITLE 10;(II) COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO THE
FEDERAL "GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., AS
AMENDED, AND IMPLEMENTING REGULATIONS, IF THE COLLECTION,PROCESSING, SALE, OR DISCLOSURE IS IN COMPLIANCE WITH THAT LAW;
(III) COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO
THE FEDERAL "DRIVER'S PRIVACY PROTECTION ACT OF 1994", 18 U.S.C.
SEC. 2721 ET SEQ., AS AMENDED, IF THE COLLECTION, PROCESSING, SALE, OR
DISCLOSURE IS REGULATED BY THAT LAW, INCLUDING IMPLEMENTING RULES,REGULATIONS, OR EXEMPTIONS;(IV) REGULATED BY THE FEDERAL "CHILDREN'S ONLINE PRIVACYPROTECTION ACT OF 1998", 15 U.S.C. SECS. 6501TO 6506, AS AMENDED, IF
COLLECTED, PROCESSED, AND MAINTAINED IN COMPLIANCE WITH THAT LAW;OR

PAGE 11-SENATE BILL 21-190

(V) REGULATED BY THE FEDERAL "FAMILY EDUCATIONAL RIGHTSAND PRIVACY ACT OF 1974", 20 U.S.C. SEC. 1232g ET SEQ., AS AMENDED,
AND ITS IMPLEMENTING REGULATIONS;(k) DATA MAINTAINED FOR EMPLOYMENT RECORDS PURPOSES;(1) AN AIR CARRIER AS DEFINED IN AND REGULATED UNDER 49 U.S.C.
SEC. 40101 ET SEQ., AS AMENDED, AND 49 U.S.C. SEC. 41713, AS AMENDED;(m) A NATIONAL SECURITIES ASSOCIATION REGISTERED PURSUANT
TO THE FEDERAL "SECURITIES EXCHANGE ACT OF 1934", 15 U.S.C. SEC.
78o-3, AS AMENDED, OR IMPLEMENTING REGULATIONS;(n) CUSTOMER DATA MAINTAINED BY A PUBLIC UTILITY AS DEFINEDIN SECTION 40-1-103 (1)(a)(I) OR AN AUTHORITY AS DEFINED IN SECTION
43-4-503 (1), IF THE DATA ARE NOT COLLECTED, MAINTAINED, DISCLOSED,
SOLD, COMMUNICATED, OR USED EXCEPT AS AUTHORIZED BY STATE AND
FEDERAL LAW;DATA MAINTAINED BY A STATE INSTITUTION OF HIGHEREDUCATION, AS DEFINED IN SECTION 23-18-102 (10), THE STATE, THE
JUDICIAL DEPARTMENT OF THE STATE, OR A COUNTY, CITY AND COUNTY, OR
MUNICIPALITY IF THE DATA IS COLLECTED, MAINTAINED, DISCLOSED,COMMUNICATED, AND USED AS AUTHORIZED BY STATE AND FEDERAL LAWFORNONCOMMERCIAL PURPOSES. THIS SUBSECTION (2)(o) DOES NOT EFFECTANY OTHER EXEMPTION AVAILABLE UNDER THIS PART 13.
(o)(p) INFORMATION USED AND DISCLOSED IN COMPLIANCE WITH 45
CFR 164.512; OR(q) A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL
INSTITUTION AS DEFINED BY AND THAT IS SUBJECT TO THE FEDERAL"GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., AS AMENDED,
AND IMPLEMENTING REGULATIONS, INCLUDING REGULATION P, 12 CFR
1016.
(3) THE OBLIGATIONS IMPOSED ON CONTROLLERS OR PROCESSORSUNDER THIS PART 13 DO NOT:(a) RESTRICT A CONTROLLER'S OR PROCESSOR'S ABILITY TO:

PAGE 12-SENATE BILL 21-190

(I) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS, RULES, OR
REGULATIONS;(II) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY,INVESTIGATION, SUBPOENA, OR SUMMONS BY FEDERAL, STATE, LOCAL, OR
OTHER GOVERNMENTAL AUTHORITIES;(III) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNINGCONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY
AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL
LAW;(IV) INVESTIGATE, EXERCISE, PREPARE FOR, OR DEFEND ACTUAL OR
ANTICIPATED LEGAL CLAIMS;(V) CONDUCT INTERNAL RESEARCH TO IMPROVE, REPAIR, OR
DEVELOP PRODUCTS, SERVICES, OR TECHNOLOGY;(VI) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR
EXISTING OR INTENDED FUNCTIONALITY;(VII) PERFORM INTERNAL OPERATIONS THAT ARE REASONABLY
ALIGNED WITH THE EXPECTATIONS OF THE CONSUMER BASED ON THE
CONSUMER'S EXISTING RELATIONSHIP WITH THE CONTROLLER;(VIII) PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTEDBY A CONSUMER OR THE PARENT OR GUARDIAN OF A CHILD, PERFORM A
CONTRACT TO WHICH THE CONSUMER IS A PARTY, OR TAKE STEPS AT THE
REQUEST OF THE CONSUMER PRIOR TO ENTERING INTO A CONTRACT;(IX) PROTECT THE VITAL INTERESTS OF THE CONSUMER OR OF
ANOTHER INDIVIDUAL;(X) PREVENT, DETECT, PROTECT AGAINST, OR RESPOND TO SECURITY
INCIDENTS, IDENTITY THEFT, FRAUD, HARASSMENT, OR MALICIOUS,
DECEPTIVE, OR ILLEGAL ACTIVITY; PRESERVE THE INTEGRITY OR SECURITY
OF SYSTEMS; OR INVESTIGATE, REPORT, OR PROSECUTE THOSE RESPONSIBLE
FOR ANY SUCH ACTION;(XI) PROCESS PERSONAL DATA FOR REASONS OF PUBLIC INTEREST IN
PAGE 13-SENATE BILL 21-190

THE AREA OF PUBLIC HEALTH, BUT SOLELY TO THE EXTENT THAT THE
PROCESSING:(A) IS SUBJECT TO SUITABLE AND SPECIFIC MEASURES TO SAFEGUARD
THE RIGHTS OF THE CONSUMER WHOSE PERSONAL DATA ARE PROCESSED;AND(B) IS UNDER THE RESPONSIBILITY OF A PROFESSIONAL SUBJECT TOCONFIDENTIALITY OBLIGATIONS UNDER FEDERAL, STATE, OR LOCAL LAW; OR(XII) ASSIST ANOTHER PERSON WITH ANY OF THE ACTIVITIES SETFORTH IN THIS SUBSECTION (3);(b) APPLY WHERE COMPLIANCE BY THE CONTROLLER OR PROCESSORWITH THIS PART 13 WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDERCOLORADO LAW;PREVENT A CONTROLLER OR PROCESSOR FROM PROVIDINGPERSONAL DATA CONCERNING A CONSUMER TO A PERSON COVERED BY AN
EVIDENTIARY PRIVILEGE UNDER COLORADO LAW AS PART OF A PRIVILEGED
COMMUNICATION;(c)(d) APPLY TO INFORMATION MADE AVAILABLE BY A THIRD PARTY
THAT THE CONTROLLER HAS A REASONABLE BASIS TO BELIEVE IS PROTECTEDSPEECH PURSUANT TO APPLICABLE LAW; AND
APPLY TO THE PROCESSING OF PERSONAL DATA BY AN
INDIVIDUAL IN THE COURSE OF A PURELY PERSONAL OR HOUSEHOLDACTIVITY.
(e)(4) PERSONAL DATA THAT ARE PROCESSED BY A CONTROLLER
PURSUANT TO AN EXCEPTION PROVIDED BY THIS SECTION:
SHALL NOT BE PROCESSED FOR ANY PURPOSE OTHER THAN A
PURPOSE EXPRESSLY LISTED IN THIS SECTION OR AS OTHERWISE AUTHORIZEDBY THIS PART 13; AND(a)(b) SHALL BE PROCESSED SOLELY TO THE EXTENT THAT THE
PROCESSING IS NECESSARY, REASONABLE, AND PROPORTIONATE TO THE
SPECIFIC PURPOSE OR PURPOSES LISTED IN THIS SECTION OR AS OTHERWISE
PAGE 14-SENATE BILL 21-190

AUTHORIZED BY THIS PART 13.
(5) IF A CONTROLLER PROCESSES PERSONAL DATA PURSUANT TO AN
EXEMPTION IN THIS SECTION, THE CONTROLLER BEARS THE BURDEN OF
DEMONSTRATING THAT THE PROCESSING QUALIFIES FOR THE EXEMPTION ANDCOMPLIES WITH THE REQUIREMENTS IN SUBSECTION (4) OF THIS SECTION.
6-1-1305. Responsibility according to role. (1) CONTROLLERS
AND PROCESSORS SHALL MEET THEIR RESPECTIVE OBLIGATIONSESTABLISHED UNDER THIS PART 13.
(2) PROCESSORS SHALL ADHERE TO THE INSTRUCTIONS OF THE
CONTROLLER AND ASSIST THE CONTROLLER TO MEET ITS OBLIGATIONSUNDER THIS PART 13. TAKING INTO ACCOUNT THE NATURE OF PROCESSING
AND THE INFORMATION AVAILABLE TO THE PROCESSOR, THE PROCESSORSHALL ASSIST THE CONTROLLER BY:
TAKING APPROPRIATE TECHNICAL AND ORGANIZATIONAL
MEASURES, INSOFAR AS THIS IS POSSIBLE, FOR THE FULFILLMENT OF THE
CONTROLLER'S OBLIGATION TO RESPOND TO CONSUMER REQUESTS TO
EXERCISE THEIR RIGHTS PURSUANT TO SECTION 6-1-1306;(a)(b) HELPING TO MEET THE CONTROLLER'S OBLIGATIONS IN RELATION
TO THE SECURITY OF PROCESSING THE PERSONAL DATA AND IN RELATION TO
THE NOTIFICATION OF A BREACH OF THE SECURITY OF THE SYSTEM PURSUANTTO SECTION 6-1-716; AND(c) PROVIDING INFORMATION TO THE CONTROLLER NECESSARY TO

ENABLE THE CONTROLLER TO CONDUCT AND DOCUMENT ANY DATAPROTECTION ASSESSMENTS REQUIRED BY SECTION 6-1-1309. THE
CONTROLLER AND PROCESSOR ARE EACH RESPONSIBLE FOR ONLY THE
MEASURES ALLOCATED TO THEM.
(3) NOTWITHSTANDING THE INSTRUCTIONS OF THE CONTROLLER, A
PROCESSOR SHALL:(a) ENSURE THAT EACH PERSON PROCESSING THE PERSONAL DATA ISSUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE DATA; AND(b)

ENGAGE A SUBCONTRACTOR ONLY AFTER PROVIDING THE

PAGE 15-SENATE BILL 21-190

CONTROLLER WITH AN OPPORTUNITY TO OBJECT AND PURSUANT TO A
WRITTEN CONTRACT IN ACCORDANCE WITH SUBSECTION (5) OF THIS SECTIONTHAT REQUIRES THE SUBCONTRACTOR TO MEET THE OBLIGATIONS OF THE
PROCESSOR WITH RESPECT TO THE PERSONAL DATA.
(4) TAKING INTO ACCOUNT THE CONTEXT OF PROCESSING, THE
CONTROLLER AND THE PROCESSOR SHALL IMPLEMENT APPROPRIATETECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE A LEVEL OF
SECURITY APPROPRIATE TO THE RISK AND ESTABLISH A CLEAR ALLOCATION
OF THE RESPONSIBILITIES BETWEEN THEM TO IMPLEMENT THE MEASURES.
(5) PROCESSING BY A PROCESSOR MUST BE GOVERNED BY A
CONTRACT BETWEEN THE CONTROLLER AND THE PROCESSOR THAT IS
BINDING ON BOTH PARTIES AND THAT SETS OUT:(a) THE PROCESSING INSTRUCTIONS TO WHICH THE PROCESSOR IS
BOUND, INCLUDING THE NATURE AND PURPOSE OF THE PROCESSING;(b) THE TYPE OF PERSONAL DATA SUBJECT TO THE PROCESSING, AND
THE DURATION OF THE PROCESSING;
THE REQUIREMENTS IMPOSED BY THIS SUBSECTION (5) AND
SUBSECTIONS (3) AND (4) OF THIS SECTION; AND(c)(d) THE FOLLOWING REQUIREMENTS:(I) AT THE CHOICE OF THE CONTROLLER, THE PROCESSOR SHALL
DELETE OR RETURN ALL PERSONAL DATA TO THE CONTROLLER AS
REQUESTED AT THE END OF THE PROVISION OF SERVICES, UNLESS RETENTION
OF THE PERSONAL DATA IS REQUIRED BY LAW;
(II) (A) THE PROCESSOR SHALL MAKE AVAILABLE TO THE
CONTROLLER ALL INFORMATION NECESSARY TO DEMONSTRATE COMPLIANCE
WITH THE OBLIGATIONS IN THIS PART 13; AND(B) THE PROCESSOR SHALL ALLOW FOR, AND CONTRIBUTE TO,
REASONABLE AUDITS AND INSPECTIONS BY THE CONTROLLER OR THE
CONTROLLER'S DESIGNATED AUDITOR. ALTERNATIVELY, THE PROCESSOR
MAY, WITH THE CONTROLLER'S CONSENT, ARRANGE FOR A QUALIFIED AND
INDEPENDENT AUDITOR TO CONDUCT, AT LEAST ANNUALLY AND AT THE
PAGE 16-SENATE BILL 21-190

PROCESSOR'S EXPENSE, AN AUDIT OF THE PROCESSOR'S POLICIES ANDTECHNICAL AND ORGANIZATIONAL MEASURES Ii\I SUPPORT OF THE
OBLIGATIONS UNDER THIS PART 13 USING AN APPROPRIATE AND ACCEPTEDCONTROL STANDARD OR FRAMEWORK AND AUDIT PROCEDURE FOR THE
AUDITS AS APPLICABLE. THE PROCESSOR SHALL PROVIDE A REPORT OF THE
AUDIT TO THE CONTROLLER UPON REQUEST.
(6) IN NO EVENT MAY A CONTRACT RELIEVE A CONTROLLER OR A
PROCESSOR FROM THE LIABILITIES IMPOSED ON THEM BY VIRTUE OF ITS ROLE
IN THE PROCESSING RELATIONSHIP AS DEFINED BY THIS PART 13.
(7) DETERMINING WHETHER A PERSON IS ACTING AS A CONTROLLEROR PROCESSOR WITH RESPECT TO A SPECIFIC PROCESSING OF DATA IS A
FACT-BASED DETERMINATION THAT DEPENDS UPON THE CONTEXT IN WHICHPERSONAL DATA ARE TO BE PROCESSED. A PERSON THAT IS NOT LIMITED IN
ITS PROCESSING OF PERSONAL DATA PURSUANT TO A CONTROLLER'S
INSTRUCTIONS, OR THAT FAILS TO ADHERE TO THE INSTRUCTIONS, IS A
CONTROLLER AND NOT A PROCESSOR WITH RESPECT TO A SPECIFIC
PROCESSING OF DATA. A PROCESSOR THAT CONTINUES TO ADHERE TO A
CONTROLLER'S INSTRUCTIONS WITH RESPECT TO A SPECIFIC PROCESSING OFPERSONAL DATA REMAINS A PROCESSOR. IF A PROCESSOR BEGINS, ALONE OR
JOINTLY WITH OTHERS, DETERMINING THE PURPOSES AND MEANS OF THE
PROCESSING OF PERSONAL DATA, IT IS A CONTROLLER WITH RESPECT TO THE
PROCESSING.
(8) (a) A CONTROLLER OR PROCESSOR THAT DISCLOSES PERSONALDATA TO ANOTHER CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THISPART 13 DOES NOT VIOLATE THIS PART 13 IF THE RECIPIENT PROCESSES THEPERSONAL DATA IN VIOLATION OF THIS PART 13, AND, AT THE TIME OFDISCLOSING THE PERSONAL DATA, THE DISCLOSING CONTROLLER OR
PROCESSOR DID NOT HAVE ACTUAL KNOWLEDGE THAT THE RECIPIENTINTENDED TO COMMIT A VIOLATION.
(b) A CONTROLLER OR PROCESSOR RECEIVING PERSONAL DATA FROM
A CONTROLLER OR PROCESSOR IN COMPLIANCE WITH THIS PART 13 AS
SPECIFIED IN SUBSECTION (8)(a) OF THIS SECTION DOES NOT VIOLATE THISPART 13 IF THE CONTROLLER OR PROCESSOR FROM WHICH IT RECEIVES THEPERSONAL DATA FAILS TO COMPLY WITH APPLICABLE OBLIGATIONS UNDER
THIS PART 13.

PAGE 17-SENATE BILL 21-190

6-1-1306.
Consumer personal data rights - repeal.
(1) CONSUMERS MAY EXERCISE THE FOLLOWING RIGHTS BY SUBMITTING A
REQUEST USING THE METHODS SPECIFIED BY THE CONTROLLER IN THE
PRIVACY NOTICE REQUIRED UNDER SECTION 6-1-1308 (1)(a). THE METHODMUST TAKE INTO ACCOUNT THE WAYS IN WHICH CONSUMERS NORMALLY
INTERACT WITH THE CONTROLLER, THE NEED FOR SECURE AND RELIABLE
COMMUNICATION RELATING TO THE REQUEST, AND THE ABILITY OF THE
CONTROLLER TO AUTHENTICATE THE IDENTITY OF THE CONSUMER MAKING
THE REQUEST. CONTROLLERS SHALL NOT REQUIRE A CONSUMER TO CREATE
A NEW ACCOUNT IN ORDER TO EXERCISE CONSUMER RIGHTS PURSUANT TO
THIS SECTION BUT MAY REQUIRE A CONSUMER TO USE AN EXISTINGACCOUNT. A CONSUMER MAY SUBMIT A REQUEST AT ANY TIME TO A
CONTROLLER SPECIFYING WHICH OF THE FOLLOWING RIGHTS THE CONSUMERWISHES TO EXERCISE:(a) Right to opt out. (I) A CONSUMER HAS THE RIGHT TO OPT OUT
OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR
PURPOSES OF:(A) TARGETED ADVERTISING;(B) THE SALE OF PERSONAL DATA; OR(C) PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL
OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER.
(II) A CONSUMER MAY AUTHORIZE ANOTHER PERSON, ACTING ON THE
CONSUMER'S BEHALF, TO OPT OUT OF THE PROCESSING OF THE CONSUMER'SPERSONAL DATA FOR ONE OR MORE OF THE PURPOSES SPECIFIED IN
SUBSECTION (1 )(a)(I) OF THIS SECTION, INCLUDING THROUGH A TECHNOLOGYINDICATING THE CONSUMER'S INTENT TO OPT OUT SUCH AS A WEB LINKINDICATING A PREFERENCE OR BROWSER SETTING, BROWSER EXTENSION, OR
GLOBAL DEVICE SETTING. A CONTROLLER SHALL COMPLY WITH AN OPT-OUT
REQUEST RECEIVED FROM A PERSON AUTHORIZED BY THE CONSUMER TO ACTON THE CONSUMER'S BEHALF IF THE CONTROLLER IS ABLE TO AUTHENTICATE,
WITH COMMERCIALLY REASONABLE EFFORT, THE IDENTITY OF THE
CONSUMER AND THE AUTHORIZED AGENT'S AUTHORITY TO ACT ON THE
CONSUMER'S BEHALF.
(III)

A CONTROLLER THAT PROCESSES PERSONAL DATA FOR

PAGE 18-SENATE BILL 21-190

PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATASHALL PROVIDE A CLEAR AND CONSPICUOUS METHOD TO EXERCISE THE
RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE
CONSUMER PURSUANT TO SUBSECTION (1 )(a)(I) OF THIS SECTION. THE
CONTROLLER SHALL PROVIDE THE OPT-OUT METHOD CLEARLY ANDCONSPICUOUSLY IN ANY PRIVACY NOTICE REQUIRED TO BE PROVIDED TO
CONSUMERS UNDER THIS PART 13, AND IN A CLEAR, CONSPICUOUS, ANDREADILY ACCESSIBLE LOCATION OUTSIDE THE PRIVACY NOTICE.
(IV) (A) A CONTROLLER THAT PROCESSES PERSONAL DATA FORPURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA MAY
ALLOW CONSUMERS TO EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING
OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OFTARGETED ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TOSUBSECTIONS (1)(a)(I)(A) AND (1)(a)(I)(B) OF THIS SECTION BY
CONTROLLERS THROUGH A USER-SELECTED UNIVERSAL OPT-OUT MECHANISMTHAT MEETS THE TECHNICAL SPECIFICATIONS ESTABLISHED BY THE
ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1313. THIS SUBSECTION(1)(a)(IV)(A) IS REPEALED, EFFECTIVE JULY 1, 2024.
(B) EFFECTIVE JULY 1, 2024, A CONTROLLER THAT PROCESSESPERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OFPERSONAL DATA SHALL ALLOW CONSUMERS TO EXERCISE THE RIGHT TO OPTOUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMERFOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATAPURSUANT TO SUBSECTIONS (1)(a)(I)(A) AND (1)(a)(I)(B) OF THIS SECTION
BY CONTROLLERS THROUGH A USER-SELECTED UNIVERSAL OPT-OUT
MECHANISM THAT MEETS THE TECHNICAL SPECIFICATIONS ESTABLISHED BY
THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1313.
(C) NOTWITHSTANDING A CONSUMER'S DECISION TO EXERCISE THE
RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA THROUGH A
UNIVERSAL OPT-OUT MECHANISM PURSUANT TO SUBSECTION (1)(a)(IV)(B)OF THIS SECTION, A CONTROLLER MAY ENABLE THE CONSUMER TO CONSENT,THROUGH A WEB PAGE, APPLICATION, OR A SIMILAR METHOD, TO THE
PROCESSING OF THE CONSUMER'S PERSONAL DATA FOR PURPOSES OFTARGETED ADVERTISING OR THE SALE OF PERSONAL DATA, AND THE
CONSENT TAKES PRECEDENCE OVER ANY CHOICE REFLECTED THROUGH THE
UNIVERSAL OPT-OUT MECHANISM. BEFORE OBTAINING A CONSUMER'SCONSENT TO PROCESS PERSONAL DATA FOR PURPOSES OF TARGETEDPAGE 19-SENATE BILL 21-190

ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO THISSUBSECTION (1)(a)(IV)(C), A CONTROLLER SHALL PROVIDE THE CONSUMERWITH A CLEAR AND CONSPICUOUS NOTICE INFORMING THE CONSUMER ABOUT
THE CHOICES AVAILABLE UNDER THIS SECTION, DESCRIBING THE CATEGORIESOF PERSONAL DATA TO BE PROCESSED AND THE PURPOSES FOR WHICH THEYWILL BE PROCESSED, AND EXPLAINING HOW AND WHERE THE CONSUMER MAY
WITHDRAW CONSENT. THE WEB PAGE, APPLICATION, OR OTHER MEANS BY
WHICH A CONTROLLER OBTAINS A CONSUMER'S CONSENT TO PROCESSPERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OFPERSONAL DATA MUST ALSO ALLOW THE CONSUMER TO REVOKE THE
CONSENT AS EASILY AS IT IS AFFIRMATIVELY PROVIDED.
(b) Right of access. A CONSUMER HAS THE RIGHT TO CONFIRM
WHETHER A CONTROLLER IS PROCESSING PERSONAL DATA CONCERNING THE
CONSUMER AND TO ACCESS THE CONSUMER'S PERSONAL DATA.
(c) Right to correction. A CONSUMER HAS THE RIGHT TO CORRECTINACCURACIES IN THE CONSUMER'S PERSONAL DATA, TAKING INTO ACCOUNTTHE NATURE OF THE PERSONAL DATA AND THE PURPOSES OF THE PROCESSING
OF THE CONSUMER'S PERSONAL DATA.
(d) Right to deletion. A CONSUMER HAS THE RIGHT TO DELETEPERSONAL DATA CONCERNING THE CONSUMER.
(e) Right to data portability. WHEN EXERCISING THE RIGHT TOACCESS PERSONAL DATA PURSUANT TO SUBSECTION (1)(b) OF THIS SECTION,
A CONSUMER HAS THE RIGHT TO OBTAIN THE PERSONAL DATA IN A PORTABLE
AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USABLE FORMATTHAT ALLOWS THE CONSUMER TO TRANSMIT THE DATA TO ANOTHER ENTITYWITHOUT HINDRANCE. A CONSUMER MAY EXERCISE THIS RIGHT NO MORE
THAN TWO TIMES PER CALENDAR YEAR. NOTHING IN THIS SUBSECTION (1)(e)REQUIRES A CONTROLLER TO PROVIDE THE DATA TO THE CONSUMER IN A
MANNER THAT WOULD DISCLOSE THE CONTROLLER'S TRADE SECRETS.
(2) Responding to consumer requests. (a) A CONTROLLER SHALL
INFORM A CONSUMER OF ANY ACTION TAKEN ON A REQUEST UNDERSUBSECTION (1) OF THIS SECTION WITHOUT UNDUE DELAY AND, IN ANYEVENT, WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF THE REQUEST. THE
CONTROLLER MAY EXTEND THE FORTY-FIVE-DAY PERIOD BY FORTY-FIVE
ADDITIONAL DAYS WHERE REASONABLY NECESSARY, TAKING INTO ACCOUNTPAGE 20-SENATE BILL 21-190

THE COMPLEXITY AND NUMBER OF THE REQUESTS. THE CONTROLLER SHALL
INFORM THE CONSUMER OF AN EXTENSION WITHIN FORTY-FIVE DAYS AFTERRECEIPT OF THE REQUEST, TOGETHER WITH THE REASONS FOR THE DELAY.
(b) IF A CONTROLLER DOES NOT TAKE ACTION ON THE REQUEST OF A
CONSUMER, THE CONTROLLER SHALL INFORM THE CONSUMER, WITHOUTUNDUE DELAY AND, AT THE LATEST, WITHIN FORTY-FIVE DAYS AFTERRECEIPT OF THE REQUEST, OF THE REASONS FOR NOT TAKING ACTION AND
INSTRUCTIONS FOR HOW TO APPEAL THE DECISION WITH THE CONTROLLER ASDESCRIBED IN SUBSECTION (3) OF THIS SECTION.
UPON REQUEST, A CONTROLLER SHALL PROVIDE TO THE
CONSUMER THE INFORMATION SPECIFIED IN THIS SECTION FREE OF CHARGE;
EXCEPT THAT, FOR A SECOND OR SUBSEQUENT REQUEST WITHIN A
TWELVE-MONTH PERIOD, THE CONTROLLER MAY CHARGE AN AMOUNTCALCULATED IN THE MANNER SPECIFIED IN SECTION 24-72-205 (5)(a).
(C)(d) A CONTROLLER IS NOT REQUIRED TO COMPLY WITH A REQUEST TO
EXERCISE ANY OF THE RIGHTS UNDER SUBSECTION (1) OF THIS SECTION IF
THE CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST USINGCOMMERCIALLY REASONABLE EFFORTS, IN WHICH CASE THE CONTROLLER
MAY REQUEST THE PROVISION OF ADDITIONAL INFORMATION REASONABLY
NECESSARY TO AUTHENTICATE THE REQUEST.
(3) (a) A CONTROLLER SHALL ESTABLISH AN INTERNAL PROCESSWHEREBY CONSUMERS MAY APPEAL A REFUSAL TO TAKE ACTION ON A
REQUEST TO EXERCISE ANY OF THE RIGHTS UNDER SUBSECTION (1) OF THISSECTION WITHIN A REASONABLE PERIOD AFTER THE CONSUMER'S RECEIPT OF
THE NOTICE SENT BY THE CONTROLLER UNDER SUBSECTION (2)(b) OF THISSECTION. THE APPEAL PROCESS MUST BE CONSPICUOUSLY AVAILABLE AND
AS EASY TO USE AS THE PROCESS FOR SUBMITTING A REQUEST UNDER THISSECTION.
(b) WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF AN APPEAL, A
CONTROLLER SHALL INFORM THE CONSUMER OF ANY ACTION TAKEN OR NOTTAKEN IN RESPONSE TO THE APPEAL, ALONG WITH A WRITTEN EXPLANATION
OF THE REASONS IN SUPPORT OF THE RESPONSE. THE CONTROLLER MAY
EXTEND THE FORTY-FIVE-DAY PERIOD BY SIXTY ADDITIONAL DAYS WHEREREASONABLY NECESSARY, TAKING INTO ACCOUNT THE COMPLEXITY AND
NUMBER OF REQUESTS SERVING AS THE BASIS FOR THE APPEAL. THE
PAGE 21-SENATE BILL 21-190

CONTROLLER SHALL INFORM THE CONSUMER OF AN EXTENSION WITHINFORTY-FIVE DAYS AFTER RECEIPT OF THE APPEAL, TOGETHER WITH THE
REASONS FOR THE DELAY.
THE CONTROLLER SHALL INFORM THE CONSUMER OF THE
CONSUMER'S ABILITY TO CONTACT THE ATTORNEY GENERAL IF THE
CONSUMER HAS CONCERNS ABOUT THE RESULT OF THE APPEAL.
(c)

6-1-1307. Processing de-identified data. (1) THIS PART 13 DOESNOT REQUIRE A CONTROLLER OR PROCESSOR TO DO ANY OF THE FOLLOWINGSOLELY FOR PURPOSES OF COMPLYING WITH THIS PART 13:(a) REIDENTIFY DE-IDENTIFIED DATA;(b) COMPLY WITH AN AUTHENTICATED CONSUMER REQUEST TOACCESS, CORRECT, DELETE, OR PROVIDE PERSONAL DATA IN A PORTABLE
FORMAT PURSUANT TO SECTION 6-1-1306 (1), IF ALL OF THE FOLLOWING ARETRUE:(I) (A) THE CONTROLLER IS NOT REASONABLY CAPABLE OF
ASSOCIATING THE REQUEST WITH THE PERSONAL DATA; OR(B) IT WOULD BE UNREASONABLY BURDENSOME FOR THE
CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA;(II) THE CONTROLLER DOES NOT USE THE PERSONAL DATA TO
RECOGNIZE OR RESPOND TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF
THE PERSONAL DATA OR ASSOCIATE THE PERSONAL DATA WITH OTHERPERSONAL DATA ABOUT THE SAME SPECIFIC CONSUMER; AND(III) THE CONTROLLER DOES NOT SELL THE PERSONAL DATA TO ANY
THIRD PARTY OR OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATATO ANY THIRD PARTY, EXCEPT AS OTHERWISE AUTHORIZED BY THE
CONSUMER; OR
MAINTAIN DATA IN IDENTIFIABLE FORM OR COLLECT, OBTAIN,RETAIN, OR ACCESS ANY DATA OR TECHNOLOGY IN ORDER TO ENABLE THE
CONTROLLER TO ASSOCIATE AN AUTHENTICATED CONSUMER REQUEST WITHPERSONAL DATA.
(c)

PAGE 22-SENATE BILL 21-190

(2) A CONTROLLER THAT USES DE-IDENTIFIED DATA SHALL EXERCISEREASONABLE OVERSIGHT TO MONITOR COMPLIANCE WITH ANYCONTRACTUAL COMMITMENTS TO WHICH THE DE-IDENTIFIED DATA ARE
SUBJECT AND SHALL TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHESOF CONTRACTUAL COMMITMENTS.
(3) THE RIGHTS CONTAINED IN SECTION 6-1-1306 (1)(b) TO (1)(e) DO
NOT APPLY TO PSEUDONYMOUS DATA IF THE CONTROLLER CAN
DEMONSTRATE THAT THE INFORMATION NECESSARY TO IDENTIFY THE
CONSUMER IS KEPT SEPARATELY AND IS SUBJECT TO EFFECTIVE TECHNICALAND ORGANIZATIONAL CONTROLS THAT PREVENT THE CONTROLLER FROMACCESSING THE INFORMATION.
6-1-1308. Duties of controllers. (1) Duty of transparency. (a) A
CONTROLLER SHALL PROVIDE CONSUMERS WITH A REASONABLY ACCESSIBLE,
CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES:(I) THE CATEGORIES OF PERSONAL DATA COLLECTED OR PROCESSEDBY THE CONTROLLER OR A PROCESSOR;(II) THE PURPOSES FOR WHICH THE CATEGORIES OF PERSONAL DATAARE PROCESSED;(III) How AND WHERE CONSUMERS MAY EXERCISE THE RIGHTSPURSUANT TO SECTION 6-1-1306, INCLUDING THE CONTROLLER'S CONTACTINFORMATION AND HOW A CONSUMER MAY APPEAL A CONTROLLER'S ACTION
WITH REGARD TO THE CONSUMER'S REQUEST;(IV) THE CATEGORIES OF PERSONAL DATA THAT THE CONTROLLERSHARES WITH THIRD PARTIES, IF ANY; AND(V) THE CATEGORIES OF THIRD PARTIES, IF ANY, WITH WHOM THE
CONTROLLER SHARES PERSONAL DATA.
(b) IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR
PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING, THE CONTROLLERSHALL CLEARLY AND CONSPICUOUSLY DISCLOSE THE SALE OR PROCESSING,
AS WELL AS THE MANNER IN WHICH A CONSUMER MAY EXERCISE THE RIGHTTO OPT OUT OF THE SALE OR PROCESSING.

PAGE 23-SENATE BILL 21-190

(c) A CONTROLLER SHALL NOT:(I) REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO
EXERCISE A RIGHT; OR(II) BASED SOLELY ON THE EXERCISE OF A RIGHT AND UNRELATED TOFEASIBILITY OR THE VALUE OF A SERVICE, INCREASE THE COST OF, OR
DECREASE THE AVAILABILITY OF, THE PRODUCT OR SERVICE.
(d) NOTHING IN THIS PART 13 SHALL BE CONSTRUED TO REQUIRE A
CONTROLLER TO PROVIDE A PRODUCT OR SERVICE THAT REQUIRES THEPERSONAL DATA OF A CONSUMER THAT THE CONTROLLER DOES NOT COLLECTOR MAINTAIN OR TO PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENTPRICE, RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A
CONSUMER, INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE
OFFER IS RELATED TO A CONSUMER'S VOLUNTARY PARTICIPATION IN A BONA
FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNT, OR CLUB CARD
PROGRAM.
(2) Duty of purpose specification. A CONTROLLER SHALL SPECIFY
THE EXPRESS PURPOSES FOR WHICH PERSONAL DATA ARE COLLECTED AND
PROCESSED.
(3) Duty of data minimization. A CONTROLLER'S COLLECTION OFPERSONAL DATA MUST BE ADEQUATE, RELEVANT, AND LIMITED TO WHAT ISREASONABLY NECESSARY IN RELATION TO THE SPECIFIED PURPOSES FOR
WHICH THE DATA ARE PROCESSED.
(4) Duty to avoid secondary use. A CONTROLLER SHALL NOTPROCESS PERSONAL DATA FOR PURPOSES THAT ARE NOT REASONABLY
NECESSARY TO OR COMPATIBLE WITH THE SPECIFIED PURPOSES FOR WHICH
THE PERSONAL DATA ARE PROCESSED, UNLESS THE CONTROLLER FIRSTOBTAINS THE CONSUMER'S CONSENT.
(5) Duty of care. A CONTROLLER SHALL TAKE REASONABLE
MEASURES TO SECURE PERSONAL DATA DURING BOTH STORAGE AND USE
FROM UNAUTHORIZED ACQUISITION. THE DATA SECURITY PRACTICES MUST
BE APPROPRIATE TO THE VOLUME, SCOPE, AND NATURE OF THE PERSONALDATA PROCESSED AND THE NATURE OF THE BUSINESS.

PAGE 24-SENATE BILL 21-190

(6) Duty to avoid unlawful discrimination. A CONTROLLER SHALLNOT PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL LAWSTHAT PROHIBIT UNLAWFUL DISCRIMINATION AGAINST CONSUMERS.
(7) Duty regarding sensitive data. A CONTROLLER SHALL NOTPROCESS A CONSUMER'S SENSITIVE DATA WITHOUT FIRST OBTAINING THE
CONSUMER'S CONSENT OR, IN THE CASE OF THE PROCESSING OF PERSONALDATA CONCERNING A KNOWN CHILD, WITHOUT FIRST OBTAINING CONSENTFROM THE CHILD'S PARENT OR LAWFUL GUARDIAN.
6-1-1309. Data protection assessments - attorney general accessand evaluation - definition. (1) A CONTROLLER SHALL NOT CONDUCTPROCESSING THAT PRESENTS A HEIGHTENED RISK OF HARM TO A CONSUMERWITHOUT CONDUCTING AND DOCUMENTING A DATA PROTECTIONASSESSMENT OF EACH OF ITS PROCESSING ACTIVITIES THAT INVOLVEPERSONAL DATA ACQUIRED ON OR AFTER THE EFFECTIVE DATE OF THISSECTION THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER.
(2) FOR PURPOSES OF THIS SECTION, "PROCESSING THAT PRESENTS AHEIGHTENED RISK OF HARM TO A CONSUMER" INCLUDES THE FOLLOWING:(a) PROCESSING PERSONAL DATA FOR PURPOSES OF TARGETEDADVERTISING OR FOR PROFILING IF THE PROFILING PRESENTS A REASONABLY
FORESEEABLE RISK OF:(I) UNFAIR OR DECEPTIVE TREATMENT OF, OR UNLAWFUL DISPARATEIMPACT ON, CONSUMERS;(II) FINANCIAL OR PHYSICAL INJURY TO CONSUMERS;(III) A PHYSICAL OR OTHER INTRUSION UPON THE SOLITUDE OR
SECLUSION, OR THE PRIVATE AFFAIRS OR CONCERNS, OF CONSUMERS IF THE
INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR(IV) OTHER SUBSTANTIAL INJURY TO CONSUMERS;(b) SELLING PERSONAL DATA; AND(c) PROCESSING SENSITIVE DATA.

PAGE 25-SENATE BILL 21-190

(3) DATA PROTECTION ASSESSMENTS MUST IDENTIFY AND WEIGH THE
BENEFITS THAT MAY FLOW, DIRECTLY AND INDIRECTLY, FROM THE
PROCESSING TO THE CONTROLLER, THE CONSUMER, OTHER STAKEHOLDERS,
AND THE PUBLIC AGAINST THE POTENTIAL RISKS TO THE RIGHTS OF THE
CONSUMER ASSOCIATED WITH THE PROCESSING, AS MITIGATED BY
SAFEGUARDS THAT THE CONTROLLER CAN EMPLOY TO REDUCE THE RISKS.
THE CONTROLLER SHALL FACTOR INTO THIS ASSESSMENT THE USE OF
DE-IDENTIFIED DATA AND THE REASONABLE EXPECTATIONS OF CONSUMERS,AS WELL AS THE CONTEXT OF THE PROCESSING AND THE RELATIONSHIPBETWEEN THE CONTROLLER AND THE CONSUMER WHOSE PERSONAL DATAWILL BE PROCESSED.
(4) A CONTROLLER SHALL MAKE THE DATA PROTECTION ASSESSMENTAVAILABLE TO THE ATTORNEY GENERAL UPON REQUEST. THE ATTORNEY
GENERAL MAY EVALUATE THE DATA PROTECTION ASSESSMENT FORCOMPLIANCE WITH THE DUTIES CONTAINED IN SECTION 6-1-1308 AND WITH
OTHER LAWS, INCLUDING THIS ARTICLE 1. DATA PROTECTION ASSESSMENTS
ARE CONFIDENTIAL AND EXEMPT FROM PUBLIC INSPECTION AND COPYING
UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF
TITLE 24. THE DISCLOSURE OF A DATA PROTECTION ASSESSMENT PURSUANT
TO A REQUEST FROM THE ATTORNEY GENERAL UNDER THIS SUBSECTION (4)DOES NOT CONSTITUTE A WAIVER OF ANY ATTORNEY-CLIENT PRIVILEGE OR
WORK-PRODUCT PROTECTION THAT MIGHT OTHERWISE EXIST WITH RESPECT
TO THE ASSESSMENT AND ANY INFORMATION CONTAINED IN THE
ASSESSMENT.
(5) A SINGLE DATA PROTECTION ASSESSMENT MAY ADDRESS ACOMPARABLE SET OF PROCESSING OPERATIONS THAT INCLUDE SIMILAR
ACTIVITIES.
(6) DATA PROTECTION ASSESSMENT REQUIREMENTS APPLY TO
PROCESSING ACTIVITIES CREATED OR GENERATED AFTER JULY 1, 2023, AND
ARE NOT RETROACTIVE.
6-1-1310. Liability. (1) NOTWITHSTANDING ANY PROVISION IN PART
1 OF THIS ARTICLE 1, THIS PART 13 DOES NOT AUTHORIZE A PRIVATE RIGHTOF ACTION FOR A VIOLATION OF THIS PART 13 OR ANY OTHER PROVISION OF
LAW. THIS SUBSECTION (1) NEITHER RELIEVES ANY PARTY FROM ANY DUTIESOR OBLIGATIONS IMPOSED, NOR ALTERS ANY INDEPENDENT RIGHTS THATCONSUMERS HAVE, UNDER OTHER LAWS, INCLUDING THIS ARTICLE 1, THE
PAGE 26-SENATE BILL 21-190

STATE CONSTITUTION, OR THE UNITED STATES CONSTITUTION.
(2) WHERE MORE THAN ONE CONTROLLER OR PROCESSOR, OR BOTH
A CONTROLLER AND A PROCESSOR, INVOLVED IN THE SAME PROCESSINGVIOLATES THIS PART 13, THE LIABILITY SHALL BE ALLOCATED AMONG THE
PARTIES ACCORDING TO PRINCIPLES OF COMPARATIVE FAULT.
6-1-1311.
Enforcement - penalties - repeal.
( 1) (a) NOTWITHSTANDING ANY OTHER PROVISION OF THIS ARTICLE 1, THE
ATTORNEY GENERAL AND DISTRICT ATTORNEYS HAVE EXCLUSIVEAUTHORITY TO ENFORCE THIS PART 13 BY BRINGING AN ACTION IN THE NAME
OF THE STATE OR AS PARENS PATRIAE ON BEHALF OF PERSONS RESIDING IN
THE STATE TO ENFORCE THIS PART 13 AS PROVIDED IN THIS ARTICLE 1,
INCLUDING SEEKING AN INJUNCTION TO ENJOIN A VIOLATION OF THIS PART
13.
(b) NOTWITHSTANDING ANY OTHER PROVISION OF THIS ARTICLE 1,
NOTHING IN THIS PART 13 SHALL BE CONSTRUED AS PROVIDING THE BASIS
FOR, OR BEING SUBJECT TO, A PRIVATE RIGHT OF ACTION FOR VIOLATIONS OF
THIS PART 13 OR ANY OTHER LAW.
(C) FOR PURPOSES ONLY OF ENFORCEMENT OF THIS PART 13 BY THE
ATTORNEY GENERAL OR A DISTRICT ATTORNEY, A VIOLATION OF THIS PART
13 IS A DECEPTIVE TRADE PRACTICE.
(d) PRIOR TO ANY ENFORCEMENT ACTION PURSUANT TO SUBSECTION(1)(a) OF THIS SECTION, THE ATTORNEY GENERAL OR DISTRICT ATTORNEY
MUST ISSUE A NOTICE OF VIOLATION TO THE CONTROLLER IF A CURE IS
DEEMED POSSIBLE. IF THE CONTROLLER FAILS TO CURE THE VIOLATIONWITHIN SIXTY DAYS AFTER RECEIPT OF THE NOTICE OF VIOLATION, AN
ACTION MAY BE BROUGHT PURSUANT TO THIS SECTION. THIS SUBSECTION(1)(d) IS REPEALED, EFFECTIVE JANUARY 1, 2025.
(2) THE STATE TREASURER SHALL CREDIT ALL RECEIPTS FROM THE
IMPOSITION OF CIVIL PENALTIES UNDER THIS PART 13 PURSUANT TO SECTION
24-31-108.
6-1-1312. Preemption - local governments. THIS PART 13
SUPERSEDES AND PREEMPTS LAWS, ORDINANCES, RESOLUTIONS,REGULATIONS, OR THE EQUIVALENT ADOPTED BY ANY STATUTORY OR HOME
PAGE 27-SENATE BILL 21-190

RULE MUNICIPALITY, COUNTY, OR CITY AND COUNTY REGARDING THE
PROCESSING OF PERSONAL DATA BY CONTROLLERS OR PROCESSORS.
6-1-1313. Rules - opt-out mechanism. (1) THE ATTORNEY
GENERAL MAY PROMULGATE RULES FOR THE PURPOSE OF CARRYING OUTTHIS PART 13.
(2) BY JULY 1, 2023, THE ATTORNEY GENERAL SHALL ADOPT RULES
THAT DETAIL THE TECHNICAL SPECIFICATIONS FOR ONE OR MORE UNIVERSAL
OPT-OUT MECHANISMS THAT CLEARLY COMMUNICATE A CONSUMER'S
AFFIRMATIVE, FREELY GIVEN, AND UNAMBIGUOUS CHOICE TO OPT OUT OF
THE PROCESSING OF PERSONAL DATA FOR PURPOSES OF TARGETEDADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO SECTION
6-1-1306 (1)(a)(I)(A) OR (1)(a)(I)(B). THE ATTORNEY GENERAL MAY
UPDATE THE RULES THAT DETAIL THE TECHNICAL SPECIFICATIONS FOR THE
MECHANISMS FROM TIME TO TIME TO REFLECT THE MEANS BY WHICH
CONSUMERS INTERACT WITH CONTROLLERS. THE RULES MUST:NOT PERMIT THE MANUFACTURER OF A PLATFORM, BROWSER,
DEVICE, OR ANY OTHER PRODUCT OFFERING A UNIVERSAL OPT-OUT
MECHANISM TO UNFAIRLY DISADVANTAGE ANOTHER CONTROLLER;(a)(b) REQUIRE CONTROLLERS TO INFORM CONSUMERS ABOUT THE
OPT-OUT CHOICES AVAILABLE UNDER SECTION 6-1-1306 (1)(a)(I);NOT ADOPT A MECHANISM THAT IS A DEFAULT SETTING, BUT
RATHER CLEARLY REPRESENTS THE CONSUMER'S AFFIRMATIVE, FREELY
GIVEN, AND UNAMBIGUOUS CHOICE TO OPT OUT OF THE PROCESSING OFPERSONAL DATA PURSUANT TO SECTION 6-1-1306 (1)(a)(I)(A) OR(1)(a)(I)(B);(c)(d) ADOPT A MECHANISM THAT IS CONSUMER-FRIENDLY, CLEARLYDESCRIBED, AND EASY TO USE BY THE AVERAGE CONSUMER;(e) ADOPT A MECHANISM THAT IS AS CONSISTENT AS POSSIBLE WITHANY OTHER SIMILAR MECHANISM REQUIRED BY LAW OR REGULATION IN THE
UNITED STATES; AND(f) PERMIT THE CONTROLLER TO ACCURATELY AUTHENTICATE THE
CONSUMER AS A RESIDENT OF THIS STATE AND DETERMINE THAT THE

PAGE 28-SENATE BILL 21-190

MECHANISM REPRESENTS A LEGITIMATE REQUEST TO OPT OUT OF THE
PROCESSING OF PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISINGOR THE SALE OF PERSONAL DATA PURSUANT TO SECTION 6-1-1306(1)(a)(I)(A) OR (1)(a)(I)(B).
(3) BY JANUARY 1, 2025, THE ATTORNEY GENERAL MAY ADOPTRULES THAT GOVERN THE PROCESS OF ISSUING OPINION LETTERS AND
INTERPRETIVE GUIDANCE TO DEVELOP AN OPERATIONAL FRAMEWORK FOR
BUSINESS THAT INCLUDES A GOOD FAITH RELIANCE DEFENSE OF AN ACTIONTHAT MAY OTHERWISE CONSTITUTE A VIOLATION OF THIS PART 13. THE
RULES MUST BECOME EFFECTIVE BY JULY 1, 2025.
SECTION 2. In Colorado Revised Statutes, amend 6-1-104 as
follows:
6-1-104. Cooperative reporting. The district attorneys may
cooperate in a statewide reporting system by receiving, on forms provided
by the attorney general, complaints from persons concerning deceptive tradepractices listed in section 6-1-105 and OR part 7 OR 13 of this article
ARTICLE 1 and transmitting such THE complaints to the attorney general.
SECTION 3. In Colorado Revised Statutes, 6-1-105, add (1)(nnn)
as follows:
6-1-105. Unfair or deceptive trade practices. (1) A person
engages in a deceptive trade practice when, in the course of the person's
business, vocation, or occupation, the person:(nnn) VIOLATES ANY PROVISION OF PART 13 OF THIS ARTICLE 1 AS
SPECIFIED IN SECTION 6-1-1311 (1)(c).
SECTION 4. In Colorado Revised Statutes, 6-1-107, amend (1)introductory portion as follows:
6-1-107. Powers of attorney general and district attorneys.
(1) When the attorney general or a district attorney has reasonable cause tobelieve that any person, whether in this state or elsewhere, has engaged inor is engaging in any deceptive trade practice listed in section 6-1-105 orpart 7 OR 13 of this article ARTICLE 1, the attorney general or district
attorney may:
PAGE 29-SENATE BILL 21-190

SECTION 5. In Colorado Revised Statutes, 6-1-108, amend (1) as
follows:
6-1-108. Subpoenas - hearings - rules. (1) When the attorney
general or a district attorney has reasonable cause to believe that a person,
whether in this state or elsewhere, has engaged in or is engaging in a
deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of thisarticle 1, the attorney general or a district attorney, in addition to otherpowers conferred upon him-orher THE ATTORNEY GENERAL OR A DISTRICTATTORNEY by this article 1, may issue subpoenas to require the attendanceof witnesses or the production of documents, administer oaths, conducthearings in aid of any investigation or inquiry, and prescribe such forms andpromulgate such rules as may be necessary to administer the provisions of
this article 1.
SECTION 6. In Colorado Revised Statutes, 6-1-110, amend (1)and (2) as follows:
6-1-110. Restraining orders - injunctions - assurances of
discontinuance. (1) Whenever the attorney general or a district attorney
has cause to believe that a person has engaged in or is engaging in any
deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of thisarticic ARTICLE 1, the attorney general or district attorney may apply for andobtain, in an action in the appropriate district court of this state, a temporary
restraining order or injunction, or both, pursuant to the Colorado rules ofcivil procedure, prohibiting such THE person from continuing such THE
practices, or engaging therein, or doing any act in furtherance thereof. The
court may make such orders or judgments as may be necessary to preventthe use or employment by such THE person of any such deceptive tradepractice or which THAT may be necessary to completely compensate orrestore to the original position of any person injured by means of any suchpractice or to prevent any unjust enrichment by any person through the use
or employment of any deceptive trade practice.
(2) Where the attorney general or a district attorney has authority toinstitute a civil action or other proceeding pursuant to the provisions of thisarticle ARTICLE 1, the attorney general or district attorney may accept, in lieu
thereof or as a part thereof, an assurance of discontinuance of any deceptive
trade practice listed in section 6-1-105 or part 7 OR 13 of this article. Stich
ARTICLE 1. THE assurance may include a stipulation for the voluntary
PAGE 30-SENATE BILL 21-190

payment by the alleged violator of the costs of investigation and any action
or proceeding by the attorney general or a district attorney and any amountnecessary to restore to any person any money or property that may havebeen acquired by such THE alleged violator by means of any such deceptive
trade practice. Any such assurance of discontinuance accepted by theattorney general or a district attorney and any such stipulation filed with thecourt as a part of any such action or proceeding shall bc is a matter of publicrecord unless the attorney general or the district attorney determines, at hisor her THE discretion OF THE ATTORNEY GENERAL OR DISTRICT ATTORNEY,
that it will be confidential to the parties to the action or proceeding and tothe court and its employees. Upon the filing of a civil action by the attorney
general or a district attorney alleging that a confidential assurance of
discontinuance or stipulation accepted pursuant to this subsection (2) has
been violated, said THE assurance of discontinuance or stipulation shallthereupon bc deemed BECOMES a public record and open to inspection by
any person. Proof by a preponderance of the evidence of a violation of any
such assurance or stipulation shall constitutc CONSTITUTES prima facie
evidence of a deceptive trade practice for the purposes of any civil action
or proceeding brought thereafter by the attorney general or a district
attorney, whether a new action or a subsequent motion or petition in any
pending action or proceeding.
SECTION 7. Act subject to petition - effective date applicability. (1) This act takes effect July 1, 2023; except that, if areferendum petition is filed pursuant to section 1 (3) of article V of the state
constitution against this act or an item, section, or part of this act within theninety-day period after final adjournment of the general assembly, then theact, item, section, or part will not take effect unless approved by the people
at the general election to be held in November 2022 and, in such case, willtake effect July 1, 2023, or on the date of the official declaration of the votethereon by the governor, whichever is later.

PAGE 31-SENATE BILL 21-190

(2) This act applies to conduct occurring on or after the applicableeffective date of this act.

d ift-05.4e-•141.

Alec Garnett
SPEAKER OF THE HOUSEOF REPRESENTATIVES

Leroy . Garcia
PRESIDENT OF
THE SENATE

erAile'd.11(gthoele.

Cindi L. Markwell
SECRETARY OF
THE SENATEAPPROVED

,m,u\

Jare

R abiv Jones
CHIEF CLERK OF T
OUSEOF REPRESENTATIVES(Date and Time).P lisE OR OF TH ST TE OF COLORADO

PAGE 32-SENATE BILL 21-190