Colorado Code
Part 13 - Colorado Privacy Act
§ 6-1-1308. Duties of Controllers

[ Editor's note: This section is effective July 1, 2023.]

(b) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose the sale or processing, as well as the manner in which a consumer may exercise the right to opt out of the sale or processing.
(c) A controller shall not:
(I) Require a consumer to create a new account in order to exercise a right; or
(II) Based solely on the exercise of a right and unrelated to feasibility or the value of a service, increase the cost of, or decrease the availability of, the product or service.
(d) Nothing in this part 13 shall be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discount, or club card program.

Source: L. 2021: Entire part added, (SB 21-190), ch. 483, p. 3460, § 1, effective July 1, 2023.