Regulations › US states › Colorado
CPA
Colorado Privacy Act
WhenIn effect since 1 July 2023
Who enforces itColorado Attorney General and district attorneys
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsControllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving…
Universal opt-outMust honor AG-recognized universal opt-out mechanisms (e.g., GPC) for targeted ads and sales s…
Cure period60-day cure period was repealed January 1, 2025
Request deadline45 days, extendable by 45 days with notice
Maximum penaltyUp to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an…
Private actionNo private right of action
68%
of Colorado's 19 requirements are already met by California (CA). Here is what CPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
CPA adds3 Internal appeal answered within 45 days (extendable 60); consumer must be told they can contact the Attorney General.
C.R.S. § 6-1-1306(3) · source ↗
Sensitive dataSensitive data and minorsBig gap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
CPA adds2 Opt-in consent for sensitive data, which includes biological and neural data since 2024; biometric identifier rules apply from July 1, 2025.
C.R.S. §§ 6-1-1303(24), 6-1-1308(7) · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
CPA adds1 Controllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving any revenue or discount from data sales; minors duties apply regardless.
C.R.S. § 6-1-1304(1) · source ↗
Children and teensSensitive data and minorsGap
CA2 Opt-in consent needed to sell or share data of consumers under 16: parental consent under 13, the teen's own consent for ages 13 to 15.
CPA adds3 Minors under 18: duty of care and consent required for targeted ads, sale, profiling, engagement features and precise geolocation; parental consent under 13.
C.R.S. § 6-1-1308.5 (SB 24-041) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
CPA adds3 Deidentified data needs reasonable measures, public commitment and contracts; pseudonymous data defined with separation requirements and rights carve-outs.
C.R.S. §§ 6-1-1303(11), (22); 6-1-1307 · source ↗
Maximum penaltyEnforcementGap
CA2 Up to $2,663 per violation and $7,988 per intentional violation or violation involving known minors under 16 (2025 adjusted).
CPA adds3 Up to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an elderly person.
C.R.S. § 6-1-112(1)(a), (c) · source ↗
Already covered by CA: Exemptions, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Private action, Rulemaking.
A gap means CPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws