On 15 March 2023, the Colorado Attorney General's ('AG') Office announced it had filed the finalised Colorado Privacy Act Rules ('the CPA Rules') with the Colorado Secretary of State. The CPA Rules will go into effect on 1 July 2023 - the same date the Colorado Privacy Act ('CPA') goes into effect.

The CPA Rules both operationalise the CPA and create additional compliance obligations for controllers, including in the areas of privacy notices, processing purposes, secondary uses, data minimisation, the processing of sensitive data inferences, Data Protection Assessments ('DPAs'), and profiling. David Stauss, Partner at Husch Blackwell LLP, identifies and discusses those areas and provides key takeaways for controllers that must comply with the CPA.

The Colorado Attorney General ('AG') announced, on 15 March 2023, that they had filed the finalised Colorado Privacy Act Rules ('the CPA Rules') with the Colorado Secretary of State's Office. In particular, the CPA Rules implement the Colorado Privacy Act ('CPA') and expand on privacy requirements, including consumer requests, data protection assessments, profiling, and the universal opt-out mechanism, among other things.

In this Insight article, OneTrust DataGuidance Research provides an overview of the finalised version of the CPA Rules, highlighting key requirements introduced by the same.

In this Insight article, Bart Huffman, Wendell Bartnick, and Haylie Treas, from Holland & Knight, address opt-out rights and related requirements under certain US state privacy laws that are currently in effect and/or will take effect in 2023.

Part one explores opt-out rights, disclosures related to these opt-out rights, and opt-out mechanisms, whereas part two analyses the processing of opt-out requests, consent and opt-in requests, other compliance considerations, and the interplay with other major federal privacy laws.

Coming in fourth place in the race to enact a comprehensive consumer privacy law, the Utah Consumer Privacy Act ('UCPA) passed through the Utah Senate and House unanimously on 25 February and 2 March 2022 respectively. Three weeks later, on 24 March, Utah Governor Spencer Cox signed Senate Bill ('SB') 227 making it the fourth comprehensive State consumer privacy law in the US.

With an effective date of 31 December 2023, the UCPA joins the Colorado Privacy Act ('CPA'), the Virginia Consumer Data Protection Act ('CDPA'), and the California Consumer Privacy Act of 2018 ('CCPA') (effective now) and the California Privacy Rights Act of 2020 ('CPRA'), which all go into effect in 2023. Of course, in the spirit of US privacy law's rapid development, even at the publication of this Insight article, a fifth consumer State privacy law has just been signed in Connecticut, with similarities and small differences to its four predecessors. Samantha Ettari, Gabriella Gallego, Naa Kai Koppoe, Ellen Choi, and Charlotte Kress, from Perkins Coie, compare the content of the UCPA to the three other States where comprehensive State privacy laws have been passed.