Two privacy laws on, one rulebook paused: compliance by capability map
Colorado and Connecticut switched on their privacy laws while a California court paused new regulations a day before enforcement. When effective dates move this much, a privacy program should be organized around four standing capabilities, with each new law mapped onto them.
Looking Back revisits one week at a time, from January 2020 to today, and asks what it meant for the banks, health systems and public agencies we serve. The series was written in 2026, with the benefit of hindsight, and each article says which week it looks back on.
The week
On July 1, 2023, the Colorado Privacy Act and Connecticut’s Data Privacy Act took effect, joining Virginia’s law, in force since January. The day before, on June 30, a California superior court ruled in a challenge to regulations the California Privacy Protection Agency had finalized at the end of March under the CPRA amendments. Enforcement of those rules was due to start on July 1. The court held that the agency could not enforce them until a year after they were finalized, pushing enforcement to late March 2024. Enforcement of the statute itself was left in place. Other states had passed their own laws that spring with later start dates. In one week, two laws went live and one set of rules moved.
For a compliance team, that week was a planning lesson in miniature. Two deadlines arrived on schedule. A third moved by nine months, a day before it was due, through a lawsuit few teams had modeled. More state laws were queued behind them with their own dates and twists. A program run as a series of go-live projects would have spent the summer rebuilding its plan. A program built around capabilities would have updated a mapping table.
Earlier in this series we looked at how narrow the sector exemptions in California’s law were. This article sets the exemption question aside. It asks what a program needs to be able to do, whatever the state. We see four capabilities: knowing the data, answering people, justifying processing, and proving all of it. Each new law then becomes a set of parameters on those four, rather than a new project.
Knowing the data
Every state law depends on facts about data the organization may not have. Which personal data it holds, about whom, from which source, for what purpose, and shared with whom. Colorado and Connecticut both treat certain categories as sensitive, including health conditions, precise location in Connecticut’s case, and data revealing racial or ethnic origin. Each category triggers consent or assessment duties.
The capability is a maintained inventory tied to systems, not a spreadsheet produced once for a privacy notice. In practice that means a named data owner for each system and a classification scheme that includes each state’s sensitive categories. It also means a change process that updates the inventory when a new marketing tool or analytics feed goes live. For banks and health systems the inventory must also record which data falls under GLBA or HIPAA, because state exemptions mostly attach to data rather than to institutions.
The gaps tend to sit outside core systems. A bank’s mortgage marketing site, a health system’s foundation donor database and a wealth manager’s event registration tool all hold personal data that no federal exemption covers. Discovery tools that scan cloud storage and SaaS applications help, but they find data, not purposes. Purpose still has to come from the business owner, so the inventory needs a quarterly attestation as well as a scanner.
Answering people
All the new laws give consumers rights to access, correct, delete and port their data, and to opt out of targeted advertising, sale and certain profiling. The details differ: response deadlines, appeal processes, how identity is verified and which data is in scope.
The capability is one intake and fulfillment workflow with configurable rules per state. A request comes in through a web form, phone line or authorized agent. The system verifies identity to a standard proportionate to the request, routes it to the data owners from the inventory, tracks the deadline that applies, and records the outcome. Appeals, which Colorado and Connecticut require, are a second queue with a different reviewer.
Opt-out preference signals belong here too. Colorado’s law required controllers to honor a recognized universal opt-out mechanism from July 1, 2024. Honoring a browser signal is an engineering task on websites and tag managers, not a policy statement. Teams that treated it as a parameter of the rights workflow could switch it on by state.
Justifying processing
The newer laws require data protection assessments for higher-risk processing, such as targeted advertising, sale, profiling with significant effects and sensitive data. They also require consent before processing sensitive data. Colorado’s attorney general issued detailed rules on what an assessment must contain, which made Colorado the de facto template.
The capability is a standard assessment that satisfies the most demanding state and is triggered by the inventory. When a team proposes a new use of sensitive or profiled data, the assessment runs before launch, records the benefits and risks, and names the approver. Consent capture for sensitive data sits alongside it, with records that show what the person agreed to and when. The trade-off is effort: a single high-water-mark assessment costs more for low-risk projects. It is still cheaper than maintaining several assessment templates and arguing about which applies.
Proving it
Regulators rarely ask whether a policy exists. They ask for evidence. That means request logs with timestamps, assessment records, processor contracts with the terms each law requires, and privacy notices that match actual practice.
The capability is a record set produced as a by-product of the other three, so that evidence is never assembled by hand after an inquiry arrives. Processor contracts deserve attention because each law specifies terms: confidentiality, deletion at the end of service, assistance with assessments and the right to object to subprocessors. A single contract addendum written to the strictest state is easier to maintain than a library of state riders.
This structure also changes how a chief compliance officer reports to the board. The question stops being which laws are live and becomes how mature each of four capabilities is, measured by request volumes, deadline performance, assessment coverage and contract coverage. When a court moves a date, the dashboard does not change. Only the mapping does.
The mapping itself needs an owner, usually in the privacy office. It also needs a short format: for each law, the effective date, the thresholds that bring the organization into scope, and the parameter values for each capability. Legal counsel should review it as each law or rule changes. That review is a few days of work per law, rather than a new program each time.
With hindsight
The calendar kept moving. In February 2024 a California appeals court reversed the June 2023 ruling, letting the agency enforce its regulations without the one-year delay. The agency went on to bring enforcement actions and to adopt further rules on risk assessments, cybersecurity audits and automated decision-making. More states passed comprehensive privacy laws in 2023, 2024 and 2025, each with its own exemptions, sensitive categories and protections for minors. Universal opt-out signals moved from a Colorado provision to a requirement in several states. Each new law tested the same four capabilities with different parameters, which is the case for organizing around them rather than around statutes. Exemption analysis for non-bank affiliates and health-adjacent data remained a common source of surprise.