Client Alert
share this page:
We kicked off 2023 with the California Privacy Rights Act (CPRA) and the Virginia Consumer Data Protection Act (VCDPA) taking effect. As we move into Summer, businesses should be preparing for more comprehensive data privacy laws to take effect. On July 1, 2023, both the Colorado Privacy Act (ColoPA) and Connecticut Data Privacy Act (CTDPA) will become effective and enforceable, and the CPRA will become enforceable by the California Privacy Protection Agency and California Attorney General. Then, to round out the year, the Utah Consumer Privacy Act (UCPA) will become effective and enforceable on December 31, 2023.
A violation of the ColoPA can result in a $20,000 penalty, which can increase to $50,000 for violations against a person over 60 years old. For the CTDPA, penalties can reach $5,000 per violation. Because of these potentially steep penalties for non-compliance, businesses should ensure they are prepared for the additional regulation and enforcement that 2023 will bring, especially for the laws taking effect on July 1.
In general, these state comprehensive privacy laws regulate certain businesses’ uses of personal data of the respective states' residents and increase consumer protections for such personal data. While these laws contain nuances, for the most part, they are substantially similar. Below is a condensed list of important activities each business that is subject to the ColoPA or CTDPA will want to conduct in order to facilitate compliance with these laws before July 1, 2023. Businesses already subject to the CPRA or VCDPA may also want to conduct these activities in order to make any necessary updates for complying with the ColoPA or CTDPA.
July 1 is only one of many upcoming, important dates in the data privacy world. The Tennessee Information Protection Act (TIPA), Iowa Consumer Data Protection Act (Iowa CDPA), Indiana Consumer Data Protection Act (Indiana CDPA), and Montana Consumer Data Privacy Act (MCDPA) are all scheduled to become effective between 2024 and 2026.
Because there is significant overlap between these laws, it may be more cost-effective and efficient for your business to review and update its data privacy practices in accordance with all of the applicable laws at once. Lewis Rice’s Cybersecurity & Data Privacy group is well-versed in the compliance process and has developed resources to assist clients with reaching and maintaining compliance with these laws.
If you have any questions about complying with these laws or other data privacy laws, or need assistance reviewing your data privacy practices, please contact one of our Cybersecurity & Data Privacy attorneys. For more information on the ColoPA or CTDPA, see our prior client alerts found here and here or check out the resources on our U.S. State Privacy Laws page.

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.
These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.
These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly.