Regulations › US states › Colorado
CPA
Colorado Privacy Act
WhenIn effect since 1 July 2023
Who enforces itColorado Attorney General and district attorneys
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsControllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving…
Universal opt-outMust honor AG-recognized universal opt-out mechanisms (e.g., GPC) for targeted ads and sales s…
Cure period60-day cure period was repealed January 1, 2025
Request deadline45 days, extendable by 45 days with notice
Maximum penaltyUp to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an…
Private actionNo private right of action
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws