Colorado has passed comprehensive data privacy legislation, which borrows, in part, from the European Union’s General Data Protection Regulation (GDPR), California Consumer Privacy Act and the Virginia Consumer Data Protection Act. The Colorado law, however, does not exempt nonprofit organizations. The Colorado Privacy Act (CPA) is a state law that gives consumers the right to know what personal information is being collected about them, why it is being collected, and how it will be used. The CPA will make Colorado the first state to explicitly require companies to honor a universal opt-out signal.
