Danny Katz
Executive Director, CoPIRG Foundation
Executive Director, CoPIRG Foundation
DENVER – Colorado consumers can mark Data Privacy Day on Tuesday by exercising their state privacy rights with the help of CoPIRG’s accessible guide. CoPIRG Foundation also released 5 steps people can take to protect their privacy now.
While nearly half of states that have passed consumer privacy laws get a failing grade for protecting consumers’ data, Colorado’s privacy laws get a C+, which is third best in the country, according to an updated scorecard report from CoPIRG Foundation and the Electronic Privacy Information Center (EPIC). Of the 19 states with laws, 8 received Fs, and none received an A.
Colorado passed the Colorado Privacy Act in 2021. Among the law’s strengths are the Attorney General’s ability to write strong clarifying rules. It also gives Coloradans the ability to use a set-it-and-forget-it browser tool to automatically tell websites they don’t want their data collected. Starting this past July, it became illegal for companies to ignore these requests.
The strength of Colorado data privacy laws dropped from 2nd place in 2024 to 3rd place this year after Maryland passed the Online Data Privacy Act, which includes a ban on the sale of sensitive data, such as location and health information, which Colorado’s law does not include. Colorado passed two amendments to its privacy law last year, including updated protections for the data of kids and teens, which earned Colorado an additional point.
“The best thing for consumers is minimizing the amount of data companies are allowed to collect upfront, and making sure companies use our date only for what we expect them to use it for,” Danny Katz, CoPIRG Foundation executive director. “The easiest data to keep secure is data that isn’t collected in the first place. Colorado’s data privacy laws are third best in the country. But there’s more to be done before our data protections earn an A.”
The more data that companies collect from a consumer, and the more companies that have a consumer’s data, the more likely it is that that consumers’ information will get exposed in a breach or a hack, making it more likely consumers will become the victim of identity theft or hyper-targeted scams.
To boost the state’s grade from a C+ to an A, Colorado should take additional actions including:
“Colorado’s law gives consumers rights, but too many of them are still too hard to use,” said Katz. “For example, you can ask companies to delete your data, but you have to ask each of them one at a time, and there are likely hundreds of companies already holding your information.”
“A lot of states have been considering bad consumer privacy bills,” said Caitrionza Fitzgerald, deputy director of EPIC and report co-author. “It’s encouraging that some states are considering a different approach.”