On December 21, 2022, the Colorado Attorney General (AG) released the second set of draft regulations to the Colorado Privacy Act (CPA). In this draft, the AG is asking public stakeholders for specific input on five different topics: (1) clarifications to definitions; (2) use of IP addresses to verify consumer requests; (3) a universal opt-out mechanism; (4) streamlining the privacy policy requirements; and (5) bona fide loyalty programs. There are some notable changes to the first draft (released in September 2022)– some of which will be welcomed by covered businesses. Agencies and their clients who are currently making operational changes concerning forthcoming privacy law changes in California (CPRA) and Virginia on January 1 should consider potential Colorado requirements to reduce future compliance costs.

...