Photo of Shelby Dolen

Shelby Dolen

Subscribe to Shelby Dolen's Posts

Shelby develops and implements comprehensive privacy programs that are tailored to the specific needs of each client, helping them to remain compliant as privacy laws continue to evolve at the state, federal, and international levels. She is well versed in all U.S. state privacy laws, laws governing social media and children’s data, AI laws and regulations, and international data privacy laws, including the GDPR.

Contact:Read more about Shelby Dolen

This article was republished in ALM’s Cybersecurity Law & Strategy Newsletter on October 31, 2025.

Key point: The rules provide further guidance to controllers subject to the law’s children’s privacy protections.

On October 9, 2025, the Colorado attorney general’s (AG) office announced final revisions to the proposed draft amendments to the Colorado Privacy Act (CPA) rules. The office published draft rules in July and solicited public comments. The final revisions reflect changes to the rules based on those public comments. The office has requested an AG opinion letter for these rules. After the opinion letter is received, the rules will be filed with the secretary of state for publication in the Colorado Register. The rules will become effective 20 days after publication.

In the below article, we provide a brief summary of the changes.

Key point: A federal district court judge rejected the claim that the disclosure law violates the First Amendment.

On October 8, 2025, a judge for the U.S. District Court for the Southern District of New York granted the New York attorney general’s (AG) motion to dismiss a lawsuit filed by a retail trade association claiming that New York’s Algorithmic Pricing Disclosure Act violates the First Amendment. Below, we provide a brief history and summary of the law and analysis of the court’s decision.

Key point: Businesses subject to the CCPA must comply with extensive new regulations.

On September 22, 2025, the California Office of Administrative Law (OAL) approved the California Privacy Protection Agency’s latest California Consumer Privacy Act (CCPA) rulemaking package. The rulemaking package covers updates to the existing regulations, automated decision-making technology (ADMT), risk assessments, cybersecurity audits, and insurance requirements.

Colorado state flags waving along with the national flag of the United States of America

Key point: Unable to reach an agreement on amending the Colorado AI Act during the special session, the Colorado legislature voted to delay the law’s effective date to June 30, 2026.

On August 26, the Colorado legislature ended its special session by voting to pass SB 4, which extends the Colorado AI Act’s effective date from February 1, 2026, to June 30, 2026. The bill will next head to Governor Jared Polis, who is expected to sign it into law.

Colorado state flags waving along with the national flag of the United States of America

Key point: Starting August 21, Colorado lawmakers will consider four bills that significantly amend the Colorado AI Act.

On August 21, Colorado lawmakers will reconvene for a special legislative session. Earlier this month, Governor Jared Polis called the special session to deal with a nearly $1 billion hole in Colorado’s state budget created by the federal government’s One Big Beautiful Bill (H.R. 1) and to consider amendments to Colorado’s first-in-the-nation Colorado AI Act.