Extract to table

121(a) further provides that a business shall restrict its use of Sensitive PI to those necessary purposes, or to uses authorized by subsequent statutory provisions, if the consumer exercises this right

These deficiencies must be addressed in the Omnibus Privacy Policy (target completion: September 12, 2025) and the California-Specific Privacy Disclosures Addendum

Businesses must not retain personal information for longer than is reasonably necessary for the disclosed purpose of collection

The Colorado Attorney General's implementing rules, which took effect on July 1, 2023, establish heightened specificity and granularity requirements for consent mechanisms used in connection with sensitive data, including requirements that: • The consent request must be presented in a clear, conspicuous, and easy-to-understand manner; • The consent must be specific to the processing activity in question and must not be bundled with consent for other, unrelated processing; • The consumer must be informed of the specific categories of sensitive data to be processed, the purposes of processing, and whether the data will be shared with third parties; • The consent mechanism must provide a genuine choice — i

the consumer must be able to decline consent without being denied the core goods or services offered by the controller; and • The controller must maintain records sufficient to demonstrate that consent was obtained in a manner consistent with these requirements

A formal data protection assessment must be conducted for this processing activity