Regulations › US states › Colorado
CPA
Colorado Privacy Act
WhenIn effect since 1 July 2023
Who enforces itColorado Attorney General and district attorneys
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsControllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving…
Universal opt-outMust honor AG-recognized universal opt-out mechanisms (e.g., GPC) for targeted ads and sales s…
Cure period60-day cure period was repealed January 1, 2025
Request deadline45 days, extendable by 45 days with notice
Maximum penaltyUp to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an…
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
Controllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving any revenue or discount from data sales; minors duties apply regardless.C.R.S. § 6-1-1304(1) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. No revenue-share minimum on the sale test; SB 24-041 minors duties bypass thresholds.
Exemptions
2
GLBA financial institutions exempt at entity level; HIPAA PHI exempt at data level; nonprofits are covered.C.R.S. § 6-1-1304(2)(a), (2)(q) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Sensitive data and minors
Sensitive data
2
Opt-in consent for sensitive data, which includes biological and neural data since 2024; biometric identifier rules apply from July 1, 2025.C.R.S. §§ 6-1-1303(24), 6-1-1308(7) · secondary source · source ↗
Neural/biological data added by HB 24-1058 (Aug. 7, 2024); HB 24-1130 biometric rules July 1, 2025. Mirror text did not yet show these.
Children and teens
3
Minors under 18: duty of care and consent required for targeted ads, sale, profiling, engagement features and precise geolocation; parental consent under 13.C.R.S. § 6-1-1308.5 (SB 24-041) · source ↗
Effective Oct. 1, 2025. Codified section number not confirmed this session; 'minor' = under 18 confirmed via TrueVault.
Data minimization
1
Collection must be adequate, relevant and limited to what is reasonably necessary for specified express purposes; new purposes need consent.C.R.S. § 6-1-1308(2)-(4) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. CPA Rules add purpose specification and retention detail.
Consumers' rights
Rights
2
Access, correct, delete, portability, and opt out of targeted advertising, sale and significant profiling.C.R.S. § 6-1-1306(1) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Request deadline
2
45 days, extendable by 45 days with notice.C.R.S. § 6-1-1306(2) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Appeals
3
Internal appeal answered within 45 days (extendable 60); consumer must be told they can contact the Attorney General.C.R.S. § 6-1-1306(3) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Universal opt-out
2
Must honor AG-recognized universal opt-out mechanisms (e.g., GPC) for targeted ads and sales since July 1, 2024.C.R.S. § 6-1-1306(1)(a)(IV); § 6-1-1313(2) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Business duties
Assessments
2
Assessments required before targeted ads or risky profiling, sale and sensitive data processing; must be provided to the AG on request.C.R.S. § 6-1-1309(1)-(4) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. Rules (Part 8) prescribe content. Colorado AI Act is separate.
Processor contracts
3
Binding contract with instructions, deletion, compliance info and audits; subcontractors only after controller can object, under flow-down contracts.C.R.S. § 6-1-1305(3), (5) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Privacy notice
3
Statutory notice of categories, purposes, rights and third parties, with detailed content and format rules in the CPA Rules.C.R.S. § 6-1-1308(1)(a); 4 CCR 904-3, Rule 6.02 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. Rule number from regulation knowledge; not read this session.
Loyalty programs
3
Bona fide loyalty programs allowed; rules require registration disclosures, partner lists, sensitive data explanations and 24-hour notice before ending benefits.C.R.S. § 6-1-1308(1)(d); 4 CCR 904-3, Rule 6.05 · secondary source · source ↗
Rule text read on Justia mirror of the Code of Colorado Regulations.
De-identified data
3
Deidentified data needs reasonable measures, public commitment and contracts; pseudonymous data defined with separation requirements and rights carve-outs.C.R.S. §§ 6-1-1303(11), (22); 6-1-1307 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. § 6-1-1307 carve-outs not read this session.
Enforcement
Who enforces
2
Attorney General and district attorneys enforce; AG has rulemaking authority.C.R.S. §§ 6-1-1311(1)(a), 6-1-1313 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Cure period
1
60-day cure period was repealed January 1, 2025.C.R.S. § 6-1-1311(1)(d) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Maximum penalty
3
Up to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an elderly person.C.R.S. § 6-1-112(1)(a), (c) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Private action
0
No private right of action.C.R.S. § 6-1-1310(1); § 6-1-1311(1)(b) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Rulemaking
3
AG rules in force (Colorado Privacy Act Rules, 4 CCR 904-3), including universal opt-out specifications.C.R.S. § 6-1-1313; 4 CCR 904-3 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws