New Privacy Laws From Coast to Coast: Comparing California, Virginia and Colorado

In 2023, new consumer privacy laws will be effective in Colorado, Virginia, and California. Of these, the Colorado Privacy Act (SB 21-190, the “CPA”) is the latest to be enacted. Effective July 1, 2023, the CPA shares many terms and concepts with the California and Virginia laws. The Colorado law borrows more heavily than the others from the General Data Protection Regulation of the European Union (the “GDPR”) in terminology, consumer rights, and the requirements of controllers (as defined below). Colorado also takes a new approach to enforcement, but with a long 60 day cure period that offers controllers an opportunity to fix issues before facing penalties. At the end of this article is a summary chart, comparing the California, Colorado and Virginia privacy laws. We note that the California Consumer Privacy Act is currently in effect, but the comparisons below and the summary chart consider the California and Virginia laws as of January 1, 2023, when the California Privacy Rights Act (“CPRA”) and Virginia (“VCDPA”) privacy laws become effective.

The CPA applies to “controllers,” defined to include persons that determine the purposes for and means of processing personal data and that (i) conduct business or produce goods or services that are intentionally targeted to Colorado residents, and (ii) either: (A) control or process personal data of more than 100,000 Coloradans per year; or (B) derive revenue from the sale of personal data of at least 25,000 Coloradans. Unlike California, the Colorado law (similar to the Virginia law) does not include the total revenue threshold that exists in California. Although Colorado does not include a broad exemption for non-profits, there are exemptions for state institutions of higher learning that maintain personal data for non-commercial purposes. Like Virginia, Colorado defines “consumer” to exclude both the information of personnel (including employees), and business contacts. In California, the personnel and business to business exemptions are currently scheduled to sunset on January 1, 2023. Many of the CPA’s exemptions follow those in Virginia, which differ from California. For example, financial institutions subject to the federal Gramm-Leach-Bliley Act of 1999 (the “GLBA”) are exempt from the Colorado and Virginia statutes; only data collected subject to the GLBA (rather than the institutions themselves) are exempt from the CPRA.

The consumer rights provided by the CPA are similar to the rights provided under the California and Virginia statutes. It affords rights of access, correction, portability and deletion, as well as rights to limit processing and to opt out of sales of data, profiling and targeted advertising. If Coloradans believe their rights are not being respected, they also have the right to appeal a controller’s determination, similar to the Virginia right to appeal. As in the GDPR, VCDPA, and CPRA, Colorado also requires controllers to enter into contracts with processors, which are defined as third parties that process personal data on the controller’s behalf, and to provide reasonable data security.

The CPA does contain some requirements, such as the requirement to perform Data Protection Assessments (“DPAs”), that will be new to many controllers that do not already process sensitive personal data under the GDPR. A DPA will be required prior to performing certain processing activities considered “high risk”. This includes processing of “sensitive data,” which includes health data, genetic or biometric data, children’s data, or data that would reveal an individual’s race, ethnicity, sexual orientation, sex life, or citizenship status. DPAs will also be required for targeted advertising or profiling if the processing could result in wide variety of otherwise reasonably foreseeable risks to Coloradans following the processing activities. Sales of personal data will also require a DPA. Although the new Colorado requirements to conduct DPAs are similar to the current GDPR requirements, these requirements are new on the U.S. privacy landscape, and will be the largest adjustment in terms of internal processes for controllers already used to many of the types of requirements such as contracting, reasonable security, and consumer rights management that already exist in California.

The CPA delegates enforcement to the Colorado Attorney General and District Attorneys, while the Attorney General will be responsible for enforcement in Virginia, and the new California Privacy Protection Agency will be charged with enforcing the CPRA. Colorado also raises the maximum penalty amounts compared to California and Virginia from $7,500 to $20,000 per violation. Colorado does, however, adopt two business-friendly provisions related to enforcement. First, like Virginia’s law and unlike California’s, the CPA does not incorporate a private right of action, which allows controllers to avoid the uncertainty of class actions and other private litigants stemming from this law. Second, the CPA provides for a 60 day cure period following a violation before penalties may be sought, in contrast to Virginia’s 30 day cure period. (It is worth noting that the current 30 day right to cure under the California law will be removed by the CPRA with respect to enforcement actions, leaving a 30 day right to cure only for private rights of action as of January 1, 2023.) The CPA’s right to cure will help controllers as they adjust to the new law and many of the new requirements.

The following chart offers a summary and comparison of the features of the California, Virginia and Colorado statutes: