Lion Cipher Lab
Does Colorado's CPA apply to you? Applicability, the universal opt-out, and consumer rights
- GRC / Compliance
- Intermediate
- ~75 min
- Free · no account required
Why it matters
Colorado was one of the earliest states after California and Virginia to switch on a comprehensive privacy law, and it is in force today - so any company that has grown past California and Virginia hits it quickly, and it is the regime that most sharply teaches two lessons the first two do not. First, like Virginia and unlike California, the CPA has no revenue-dollar trigger at all, so a business that would be squarely covered in California can be entirely out in Colorado - and its second prong bites on ANY revenue or discount from selling data, with no 50% ratio, which is a real trap for…
What you'll learn
- running the Colorado CPA applicability test as TWO prongs and seeing that both are consumer counts, never a revenue-dollar figure
- explaining why a business can clear a huge revenue bar and still be entirely out of the CPA
- seeing how Colorado's SECOND prong differs from Virginia's - it needs no 50% ratio, only ANY revenue or a discount from selling data plus 25,000 consumers
- applying the permanent B2B and HR/employee carve-out that removes commercial and employment data from scope
- recognizing sensitive data and knowing it needs opt-IN consent before processing, not merely a right to limit
- wiring the UNIVERSAL OPT-OUT MECHANISM into a programme and dating the duty correctly to 1 July 2024
- mapping the five Colorado consumer rights onto an intake-to-response workflow with the 45-day clock and the MANDATORY appeal step
- listing the kinds of processing that force a Data Protection Assessment
- getting enforcement right - Attorney General AND district attorneys, no private right of action, and a right-to-cure that SUNSET on 1 January 2025
- contrasting the CPA against BOTH California and Virginia so 'we did the other states' becomes a specific list of deltas
Steps in this lab
- The vocabulary, the citation, and who enforces this
- Set up the worksheet - four tabs, named now, filled as you go
- The applicability test - run BOTH prongs, and notice they are both counts
- Scope and definitions - the permanent B2B/HR carve-out, sensitive data, and the exemptions
- The consumer rights and the workflow - the 45-day clock and the MANDATORY appeal
- The obligations - the privacy notice, the DPA triggers, and the universal opt-out mechanism
- CPA vs CCPA vs VCDPA - the differences that change your answer (aside)
- The pro move - build to the multi-state matrix, not one law at a time