Everything You Should Know about the Colorado Privacy Act

Personal data is defined as “information that is linked or reasonably linkable to an identified or identifiable individual.” It does not include de-identified data or publicly available information.

Yes. A "reasonably accessible, clear, and meaningful privacy notice" outlines details like the categories of personal data collected or processed, the reasons for doing so, how users can exercise their rights, and disclosures regarding the selling and sharing of personal data is required from controllers.

Controllers are required to obtain consumers’ consent before processing sensitive data. Sensitive data includes personal information that may be processed to uniquely identify a person, such as genetic or biometric information, as well as information about a known child's racial or ethnic origin, religious beliefs, mental or physical health condition, or diagnosis, sex life or sexual orientation, citizenship, or status as a citizen.