Colorado placed third in the race to enact a state privacy law, but its middle-of-the-road blend of features could make it the crowd favorite for the next round of U.S. privacy discussions. The Colorado Privacy Act (CPA) includes strong consumer rights and simplifies key obligations on businesses set out in its California and Virginia predecessors. With commentary from privacy specialists, including an attorney from the AG’s office, this article explains the CPA’s requirements and compliance twists, and shines a light on distinct enforcement risks in Colorado arising from the AG’s strategic shaping of the law. See “Familiar and Fresh Mandates in Virginia’s New Privacy Law” (Mar. 10, 2021).