Colorado Privacy Act (CPA): Rights, Scope, and Penalties

The state of Colorado passed the Colorado Privacy Act (CPA) in July 2021, making it the third U.S. state to enact a comprehensive data privacy law, following California in 2018 and Virginia earlier in 2021. The Colorado privacy law came into effect on July 1, 2023, and has received several updates since. We look at the Colorado Privacy Act, what rights it grants to consumers, and what steps businesses must take to comply with its provisions.

What Is the Colorado Privacy Act?

The Colorado Privacy Act (CPA) is a state-level consumer privacy law that protects the personal data of Colorado residents. The CPA imposes data protection requirements on companies or organizations that operate in the state or offer goods or services to residents, known as “consumers” under the law, and process their personal data.

The CPA defines consumers as individuals who are residents of Colorado and acting in an individual or household context. It excludes individuals acting in a commercial or employment context, as a job applicant, or as a beneficiary of another person acting in an employment context.

The CPA follows an opt-out model consistent with other U.S. state-level data privacy laws. It gives Colorado consumers the right to opt out of the processing of their personal data for targeted advertising, sale, and certain types of profiling. Businesses aren’t required to obtain consent before collecting consumers’ personal data in most cases, with exceptions for:

• Sensitive data
• Personal data belonging to children under the age of 13
• Processing for secondary purposes, i.e., purposes other than what was previously communicated to consumers
• Personal data of minors under 18, when used for targeted advertising, sale, or profiling

Key Terms Defined in the Colorado Privacy Act

The Colorado Privacy Act defines several key terms related to the data it protects and the data processing activities it regulates.

What Is Personal Data Under the CPA?

Personal data under the Colorado privacy law means “information that is linked or reasonably linkable to an identified or identifiable individual.”

The definition specifically excludes deidentified data and publicly available information.

The law doesn’t give examples of what constitutes personal data, as some of the other U.S. privacy laws do, but common types that businesses collect could include email address, name, phone number, and Social Security number.

What Is Sensitive Data Under the CPA?

Sensitive data is a type of personal data that requires opt-in consent before it is processed, because misuse can cause greater harm to the consumer. It includes data that reveals:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health condition or diagnosis
• Sex life or sexual orientation
• Citizenship or citizenship status

The CPA also treats the following as sensitive data: personal data of a known child under 13; genetic or biometric data processed to uniquely identify an individual; biological data, including neural data (added in August 2024 by HB 24-1058); and precise geolocation data (added by SB 25-276, signed May 23, 2025, and in force by October 1, 2025). Controllers also may not sell sensitive data without consent.

Who Is a Controller Under the CPA?

The CPA defines a controller as a “person that, alone or jointly with others, determines the purposes for and means of processing personal data.”

“Person” includes an organization, business, or other entity that collects and processes personal data (unless exempt under the law) if they determine why and how personal data is processed.

Who Is a Processor Under the CPA?

The CPA defines a processor as a “person that processes personal data on behalf of the controller." Processors must follow the controller’s instructions and assist the controller in meeting obligations under the law. Like with controllers, “person” in the definition of processor also includes an organization, business, or other entity.

What Is Consent Under the CPA?

The Colorado data privacy law defines consent as “a clear, affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement, such as by a written statement, including by electronic means, or other clear, affirmative action by which the consumer signifies agreement to the processing of personal data.”

This definition is influenced by the European Union’s General Data Protection Regulation (GDPR).

The law specifies that the following activities are not considered consent:

• Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information
• Hovering over, muting, pausing, or closing a given piece of content
• Agreement obtained through dark patterns

What Is a Sale Under the CPA?

The CPA broadly defines sale as “the exchange of personal data for monetary or other valuable consideration by a controller to a third party.”

The definition specifically excludes the following disclosures of personal data:

• To a processor
• To a third party to provide a product or service the consumer has requested
• To the controller’s affiliate, including transfer of personal data
• As an asset as part of a proposed or actual merger, acquisition, bankruptcy, or other transaction, including transfer of personal data
• That a consumer:
  • Directs the consumer to disclose
  • Intentionally discloses by using a controller to interact with a third party
  • Intentionally makes available to the general public through mass media

What Is Targeted Advertising Under the CPA?

The CPA defines targeted advertising as displaying ads to a consumer that are “selected based on personal data obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications, or online services to predict consumer preferences or interests.”

Targeted advertising doesn’t include:

• Ads displayed to a consumer in response to their request for information or feedback
• Ads based on activities within a controller's own websites or online applications
• Ads based on the context of a consumer's current search query, visit to a website, or online application
• Personal data processed only for measuring or reporting advertising performance, reach, or frequency

Who Does the Colorado Privacy Act Apply To?

The CPA applies only to businesses that meet at least one data-volume threshold. The CPA applies to businesses that either conduct business in Colorado or produce or deliver commercial products or services that are purposely targeted to Colorado residents, and also meet one or both of the following requirements:

• Control or process personal data of at least 100,000 consumers a calendar year
• Control or process personal data of at least 25,000 consumers a year, and derive revenue or receive a discount on goods or services from the sale of personal data

Controllers that process biometric identifiers or biometric data, and those that offer online services to minors, must meet the related obligations regardless of these thresholds.

Unlike California, Colorado has no threshold that depends on annual revenue alone. There is also no minimum revenue or discount required from the sale of personal data for the law to apply.

Exemptions to Colorado Privacy Act Compliance

In addition to businesses that don’t meet the compliance thresholds, the following types of entities are among those exempt from CPA compliance:

• Covered entities and business associates under the Health Insurance Portability and Accountability Act (HIPAA)
• State institutions of higher education
• National securities associations
• Air carriers
• Financial institutions and their affiliates subject to the Gramm-Leach-Bliley Act (GLBA)

Data that is exempt from compliance includes, among others:

• Protected health information and patient identifying information
• Research data
• Deidentified data
• Employment records
• Data maintained by public utilities, where used as authorized by state and federal law
• Data already regulated under other laws, including:
  • GLBA
  • Fair Credit Reporting Act (FCRA)
  • Driver’s Privacy Protection Act (DPPA)
  • Children’s Online Privacy Protection Act (COPPA)
  • Family Educational Rights and Privacy Act (FERPA)

Unlike some other states’ consumer privacy laws, there is no specific exemption for nonprofit organizations or small businesses under the Colorado privacy law. If they meet the compliance thresholds and do not fall under one of the exemptions outlined in the law, the CPA is applicable to them.

Consumer Rights Under the Colorado Privacy Act

The CPA empowers Colorado consumers with the following five rights:

• Right to opt out: Consumers can opt out of the processing of their personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning them.
• Right of access: Consumers are entitled to confirm whether a controller is processing personal data about them and, if so, to access that data.
• Right to correction: Consumers can request that inaccuracies in their data be corrected, taking into account the nature of the personal data and the purpose of the processing.
• Right to data portability: Consumers are entitled to obtain their personal data in a portable and readily usable format and to transmit it to another entity without interference from the controller.
• Right to deletion: Consumers have the right to delete personal data concerning themselves, with exceptions.

The CPA also gives consumers the right to appeal a business’s denial to act on a request within a reasonable time period.

What Does the Colorado Privacy Act Say About Cookies and Trackers?

Even though the Colorado privacy law does not talk about cookies and trackers specifically, its definition of personal data includes such identifiable data as email addresses and usernames that are often collected through cookies.

The CPA requires businesses to enable visitors to opt out of targeted advertising and the sale of personal data. Cookies and trackers that collect and process personal data for these purposes therefore need to be controlled, for example by a consent management solution that gives visitors the technical ability to say yes or no, ideally at a granular level.

If your website uses third-party marketing cookies or other trackers that process personal data for advertising, you must be transparent about this in your privacy notice, and you must give Colorado consumers the choice to opt out of targeted advertising and the sale of their personal data.

Controllers’ Obligations Under the Colorado Privacy Act

Under the Colorado data privacy law, controllers are required to meet specific obligations to protect consumers' personal data.

Consumer Rights Requests Under the CPA

The CPA gives controllers 45 days to respond to an authenticated consumer request. Controllers may take an additional 45 days where reasonably necessary, provided you inform the consumer within the first 45-day period and include the reason for the delay.

Consumers can be asked to use an existing account to verify their identity, but they cannot be asked to create a new account for this purpose.

Controllers must inform the consumer within 45 days if they are not taking action on a consumer request, and share with the consumer the method of appeal. An appeal must be decided within 45 days, with an extension of another 60 days being permitted where reasonably necessary. Controllers must share a written explanation of their decision with the consumer to take an action or not within these prescribed time frames.

Controllers must also inform consumers about their option to contact the Attorney General if they have concerns about an appeal’s result.

Privacy Policy Under the CPA

Controllers must uphold a duty of transparency under the CPA and provide consumers with a “reasonably accessible, clear, and meaningful privacy notice” or privacy policy. A CPA-compliant privacy notice must include:

• Categories of the personal data collected or processed
• Purposes for processing personal data
• Categories of personal data shared with third parties
• Categories of third parties that personal data is shared with
• How and where consumers can exercise their rights under the law, including contact information for the controller and information about appealing a controller’s action with regard to consumer requests

Controllers may share this information in a privacy policy or privacy notice published on their website, often through a link in the footer that makes it easily accessible to consumers from any page on the site. The law also requires controllers with an app to publish it on their download page, app store page, and app’s settings menu.

Avoid Unlawful Discrimination Under the CPA

The Colorado privacy law prohibits controllers from processing personal data in a manner that violates any state or federal anti-discrimination laws.

Consent Requirements Under the CPA

The CPA follows an opt-out consent model, meaning that, in most cases, controllers don’t need prior consent to collect and process consumer data. There are certain exceptions where the Colorado privacy law requires you to first obtain opt-in consent from consumers:

• Secondary uses of personal data, i.e., purposes other than those that the consumer has already been informed of via privacy notice or other disclosures
• Processing sensitive data, including selling it
• Processing personal data of a known child under age 13
• Processing personal data of a minor under 18 for targeted advertising, sale, or profiling

For children’s data, controllers must obtain prior consent from the child’s parent or legal guardian.

If your website already offers a California opt-out link, you have a useful starting point, but Colorado has its own requirements, including recognition of universal opt-out mechanisms and opt-in consent for sensitive data.

Universal Opt-Out Mechanism Under the CPA

The Colorado data privacy law incorporates a provision for enabling a universal opt-out mechanism, such as the Global Privacy Control (GPC). This mechanism enables consumers to set their data processing preferences once, often through browser settings or a plugin, and have those preferences automatically applied across all websites they visit.

Colorado controllers have been required to honor universal opt-out mechanisms since July 1, 2024. The Colorado Attorney General maintains the official list of recognized mechanisms, and Global Privacy Control is on it. Under the CPA rules, a mechanism must reflect the consumer’s affirmative choice, so a signal that a browser or operating system turns on by default does not qualify.

As of 2026, 12 states require businesses to honor universal opt-out signals: California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, and Texas.

Data Minimization Under the CPA

The CPA requires controllers to inform consumers about the purposes of data collection, and to follow the principle of data minimization by only collecting personal data that is “adequate, relevant, and limited” to what is reasonably necessary for these purposes.

If you wish to process the personal data you’ve collected for any other purposes, the law requires you to notify consumers of the new purpose(s), and obtain their consent prior to further data collection or processing for it.

Data Security Under the CPA

Controllers must take reasonable measures during the storage and use of personal data to secure it from unauthorized access or security breach.

Although the law does not specify what “reasonable measures” means, it specifies that controllers’ data security practices should be “appropriate to the volume, scope, and nature of the personal data processed and the nature of the business”. So, for example, the greater the volume of data processed, or the more sensitive in nature, the stronger the security measures need to be.

Data Protection Impact Assessment (DPIA) Under the CPA

The CPA requires controllers to conduct and document data protection assessments, also known as Data Protection Impact Assessments (DPIA), under some circumstances, like when they undertake processing activities that present a heightened risk of harm to the consumer, such as:

• Processing personal data for the purposes of targeted advertising
• Sale of personal data
• Processing sensitive data
• Processing personal data for the purposes of profiling that presents a foreseeable risk of:
  • Unfair or deceptive treatment of consumers
  • Financial or physical injury to consumers
  • Physical or other intrusion into consumers’ private affairs
  • Other substantial injury to consumers

Controllers must comply with a request from the Attorney General’s office to make a DPIA available in the course of an investigation. Assessment documentation must be kept for as long as the processing continues and for at least three years afterward. For online services offered to minors, SB 24-041 (effective October 1, 2025) also requires an assessment where the service presents a heightened risk of harm to minors.

Data Processing Agreements (DPA) Under the CPA

Controllers must enter into contracts with processors before data processing begins. These contracts, while not explicitly referred to as "data processing agreements" under the CPA, serve a similar purpose to those required by other privacy laws, such as the GDPR and the Virginia Consumer Data Protection Act (VCDPA). The contract must clearly outline processing requirements and obligations between the controller and processor, such as:

• Instructions for processing
• Nature and purpose of processing
• Type of personal data subject to processing
• Duration of processing
• Duty of confidentiality
• Conditions under which the processor may engage a subcontractor
• Responsibility of both parties to maintain appropriate data security measures
• Requirement that the processor must delete or return all personal data at the controller’s request at the end of the contract
• Processor’s obligation to allow for, or contribute to, reasonable audits and inspections
• Processor’s obligation to share all information demonstrating compliance with the law

Under most data privacy laws, controllers are ultimately responsible for any data processing violations or breaches committed by processors. However, under the CPA, there are two specific exceptions to this rule.

If a controller or processor lawfully shares personal data with a third-party controller or processor, they are not liable for any violations committed by the receiving party, provided they were unaware of any intent to violate the law at the time of sharing.

If a controller or processor lawfully receives personal data, they are not responsible for any legal violations committed by the disclosing party.

Recent Amendments and Rule Changes

Colorado has amended the CPA several times since it took effect, and the Attorney General has updated its rules alongside. Controllers should be aware of the following changes.

• Biological and neural data (August 2024): HB 24-1058 added biological data and neural data to the definition of sensitive data.
• Rules (January 30, 2025): Amendments to the CPA rules created a process for opinion letters and interpretive guidance from the Attorney General, among other changes.
• Biometric data (July 1, 2025): HB 24-1130 requires controllers to give notice and, in most cases, obtain consent before collecting biometric identifiers. It also requires a written retention and deletion schedule and restricts selling or leasing biometric identifiers. The obligations extend to employers that collect biometric data from employees and job applicants.
• Precise geolocation (signed May 23, 2025): SB 25-276 added precise geolocation data to sensitive data and prohibits selling sensitive data without consent.
• Minors (October 1, 2025): SB 24-041 extends protections to all consumers under 18. Controllers must use reasonable care to avoid heightened risk of harm to minors, obtain consent before processing a minor’s data for targeted advertising, sale, or profiling, and conduct a data protection assessment for online services that present a heightened risk to minors. Rules adopted on October 8, 2025 clarify when a controller “willfully disregards” that a consumer is a minor and when a design feature counts as addictive.

Colorado’s Separate Law on Automated Decision-Making

Colorado’s Automated Decision-Making Technology Act (SB 26-189), signed on May 14, 2026, replaces the Colorado AI Act (SB 24-205) and takes effect on January 1, 2027. It is a distinct law from the CPA and applies to developers and deployers of automated decision-making technology used in consequential decisions. The Attorney General is conducting rulemaking to implement it.

Colorado Privacy Act Penalties and Enforcement

The Colorado Attorney General and District Attorneys have exclusive enforcement authority under the CPA. Colorado residents do not have a private right of action, preventing individuals from filing lawsuits directly for CPA violations.

Violations of the CPA are classified as deceptive trade practices under Colorado law, which can lead to significant penalties. The general cure period expired on January 1, 2025, so the Attorney General or a District Attorney may now bring an action for most violations without first issuing a notice and allowing time to cure. A 60-day cure period still applies to violations of the minors’ provisions until December 31, 2026.

Fines and Penalties Under the CPA

Financial penalties for noncompliance with the CPA are governed by the Colorado Consumer Protection Act, which allows civil penalties of:

• Up to USD 20,000 per violation in most cases
• Up to USD 50,000 per violation against an elderly person

What Are the Colorado Privacy Act Rules and Regulations?

The CPA Rules were finalized by the Colorado Attorney General on March 15, 2023 to clarify and expand upon the CPA’s requirements. These regulations took effect on July 1, 2023, and include several key provisions, such as:

• A universal opt-out mechanism should not be the default setting for a browser or operating system that comes pre-installed on a device, since a default setting is not an affirmative, freely given, and unambiguous choice by the consumer
• Personal data provided in response to a right to access request must be presented in the language in which the consumer normally interacts with the controller
• Privacy notices and other disclosures or communications must be reasonably accessible to consumers with disabilities, including through the use of digital accessibility tools
• Privacy notices must be posted online through a link that uses the word “privacy” on the controller’s website homepage, app store page, download page, or app settings menu, as applicable
• Biometric identifiers, digital or physical photographs of a person, audio or voice recordings containing the voice of a person, or any personal data generated from them must be reviewed at least once a year to determine if storage is still necessary, adequate, or relevant for the processing purposes

The Attorney General has amended the rules since 2023, with changes effective January 30, 2025 and further minors’ protection amendments adopted on October 8, 2025.

Steps Toward Compliance with the Colorado Privacy Act

Businesses that meet the CPA’s thresholds must take necessary steps to comply with its requirements.

• Publish a comprehensive privacy notice on your website, app, download page, or app store page that details your data processing policies. Your privacy policy must inform consumers how they can exercise their rights under the law. Businesses often link to their privacy policy in their website’s footer and on the cookie banner.
• Provide consumers with an opt-out mechanism that enables them to opt out of the sale of their personal data or its use for targeted advertising or profiling.
• Obtain opt-in consent for the collection and processing of sensitive data, data belonging to a known child under 13, and secondary uses of personal data. For consumers under 18, obtain consent before using their data for targeted advertising, sale, or profiling.
• Collect only the personal data you need for the specified purposes, in line with the principle of data minimization.
• Enter into a contract with processors that outlines the rights and responsibilities as specified under the law.
• Set up a system for consumers to exercise their rights under the CPA and for you to verify their identity. Respond to consumer rights requests within the prescribed time.
• Conduct a data protection assessment for high-risk data processing activities to protect consumers’ data.