What does NOT count as personal data under the Colorado Privacy Act?
<p>The Colorado Privacy Act defines personal data rather vaguely. It is data that can  &quot;REASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE
LINKED TO, AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL, OR A DEVICE
LINKED TO SUCH AN INDIVIDUAL&quot;</p>
<p>It almost seems as if any piece of information, or combination of information, that can be used to link an individual to a real-life identity constitutes personal data under the Act.</p>
<p>For example, if a published dataset of customers reveals that one of them lives in Grand Junction and has 172 great-grandchildren, and there is only one person in Grand Junction that has that many great-grandchildren, that information might be personal data.</p>

<h2>Yes, &quot;any piece of information, or combination of information, that can be used to link an individual to a real-life identity constitutes personal data under the Act.&quot;</h2>
<p>That's the point.</p>
<p>Note that the act only applies to businesses that control or process the personal data of 100,000 or more consumers per year or 25,000 if they derive revenue or receive a discount on the price of goods or services from the sale of personal data. Deidentified data and publicly available information are <em>not</em> personal data under the Act.</p>

colorado