alt Hacker NewsIt’s right at the top of the linked bill.
The attorney general or a district attorney may bring a civil action on behalf of the state against a person that violates the prohibition against individualized price or wage setting based on surveillance data to seek the imposition of civil penalties. In addition, a person aggrieved by a violation of the prohibition specified in the bill may bring a civil action on behalf of themself or a group of similarly situated persons to restrain further violations and to recover damages, costs, and reasonable attorney fees. A violation of the prohibition against individualized price setting or individualized wage setting is a deceptive trade practice under the "Colorado Consumer Protection Act".
Allowing private right of action means this will be weaponized by attorneys in the same way the ADA has. Just scanning the bill, any small business in the US using dynamic pricing, targeted discounts or "VIP pricing" on their website would be open to suits from Colorado residents. The definitions are extremely broad and there is no safe harbor for small companies either. Damages are also uncapped and apparently Colorado allows treble damages for CCPA violations.