United States of America: Entry into force with grace period Colorado Privacy Act Rules

On 15 March 2023, the Colorado Privacy Act Rules were finalised by filing with the Secretary of State. The final rules will be published in the Colorado Register in March 2023, coming into effect on 1 July 2023. The rules generally specify how rights and procedures under the Act are appropriately carried out. Notably, the Rules introduce updates to several definitions under the Act, including the right to opt-out, the right of action, the right to correction, the right to deletion, the right to data portability, obligations of controllers, privacy notice content, renewal and withdrawal of consent, among others. A number of obligations, including the obligation of controllers to respect the exercise of opt-out requests through a Universal Opt-Out Mechanism and the requirement to obtain consent for the continued processing of previously collected sensitive information, will enter into effect only on 1 July 2024.