Has this ever happened to you? You’re online reading about a product, and then a few minutes later every ad on your phone is for that type of product. That all-too-common occurrence is just one example of many in which our personal data seems decidedly not private. Fortunately, help is on the way.

Last year, the General Assembly made Colorado one of the first states in the country to push back on the unfettered use of personal data by enacting comprehensive data privacy legislation. Starting July 1, Colorado consumers will have new rights. And private companies and nonprofits that process large amounts of consumer data will have new obligations to protect privacy.

I recently approved groundbreaking new rules implementing that law. Those rules were drafted after months of conversation and feedback from organizations, companies, and consumers across the state and the country that participated in the rulemaking process. Those rules will help entities that collect and use consumer data – known as controllers – comply with the requirements of the new law.

Stay up to speed: Sign-up for daily opinion in your inbox Monday-Friday

When it comes to regulating any emerging technology, it’s important for government to be nimble, responsive and understand the evolving landscape. Government can’t effectively regulate technologically dynamic industries unless we operate quickly and skillfully. Thanks to the hard work and dedication of the Department of Law, these data privacy rules do just that and will set a new standard for other states to follow.

Throughout the process, our goal was to create rules that businesses and nonprofits can understand and follow – not set traps or create a “gotcha” game for data controllers. To use a basketball analogy, we are not going to take on those who are trying to implement the law and commit the equivalent of a ticky-tack foul; rather, we are looking to hold accountable those committing flagrant ones, making clear that these rules must be taken seriously.

For Colorado consumers, the law will help them gain new insight into how controllers collect, share and sell their data – and how that data is used. Importantly, Colorado consumers will soon be able to opt out of the sale of personal data, targeted advertising and profiling used to make certain types of automated decisions. Consumers will also be asked for their consent for controllers to use their sensitive personal data.

That last part is critical. In the wake of last year’s U.S. Supreme Court decision in Dobbs, many people asked the question of whether anyone was tracking if someone entered an abortion clinic or sought reproductive care. By requiring companies to get consent before collecting sensitive data, we’re helping to put people’s minds at ease that their very private, personal decisions won’t be tracked without their knowledge and permission.

Consumers also have the right to request their personal data from a company, correct it if necessary, and request it be deleted. Though these rights won’t stop every unwanted or unsettling instance of the use of our private data, it’s an important start.

The benefits to consumers from this law are obvious. The new Colorado Privacy Act also offers some advantages to businesses. To be sure, they will have to do some work to comply with the law, but it will also give them an opportunity to ask themselves whether all the data they collect is necessary. Companies that collect less data are at an advantage because they are limiting their own liability if data is breached or compromised, an event which is often more of a question of when than if these days. It also advantages them by boosting consumer trust.

At the Department of Law, we want to help make it easier for businesses to comply with these new responsibilities. That’s why the department is working to share resources on our website that explain the law, outline the rules and go in-depth as to what businesses and other data controllers need to know.

When it comes to our personal data, there’s no going back to the way things were before the turn of the century. The proverbial toothpaste is out of the tube. Thanks to the Colorado Privacy Act, consumers will have more tools to protect ourselves and our data privacy. It’s your data. Now you’ll have the right to decide what to do with it – and what others can do with it. We will work tirelessly to ensure that data controllers and consumers will be on the same page when it comes to our data. Together, we can keep Colorado on the cutting edge of protecting consumers.

Phil Weiser is attorney general of Colorado.