Colorado Privacy Act (CPA): U.S. Business Compliance Guide

Colorado enacted the Colorado Privacy Act (CPA) in July 2021, and the law came into force on July 1, 2023. It made Colorado the third U.S. state to enact a comprehensive consumer data privacy law after California and Virginia. As one of the earliest modern U.S. state privacy laws, it has gone through several amendments.

The CPA grants Colorado residents, who are referred to in the law as “consumers”, a set of enforceable rights over their personal data, and it places binding obligations on businesses that collect or process that data.

For U.S. companies operating websites, apps, or digital services that reach Colorado consumers, the CPA is a live compliance requirement, not a future consideration. Even businesses headquartered elsewhere must comply if they process Colorado residents’ personal data and meet the law’s coverage thresholds. 

This guide explains exactly what the CPA requires, how it compares to other state privacy laws, and what practical steps your organization needs to take to remain compliant.

What is the Colorado Privacy Act (CPA)?

The Colorado Privacy Act is a state-level consumer data privacy statute encoded in the Colorado Revised Statutes, Title 6, Article 1, Part 13. It followed closely on the passage of Virginia’s Consumer Data Protection Act earlier that year.

The CPA’s core purpose is to give Colorado residents meaningful control over how their personal data is collected, used, and shared by businesses. 

Rather than requiring consent before all data collection as the EU’s General Data Protection Regulation (GDPR) does, the CPA adopts an opt-out framework, meaning businesses may generally process consumer data without prior consent, unless the data is sensitive, belongs to a child, or is being used for secondary purposes not previously disclosed.

The Colorado Attorney General’s Office is responsible for enforcement, and it finalized implementing rules on March 15, 2023, covering universal opt-out mechanisms, privacy notice requirements, accessibility standards, and biometric data retention. The Attorney General has amended the rules since, most recently by adopting minors’ protection amendments on October 8, 2025.

Key Definitions Under the Colorado Privacy Act

Understanding the CPA requires clarity on how the law defines several foundational terms.

Personal Data

Personal data under the CPA means any information that is linked or reasonably linkable to an identified or identifiable individual. The definition excludes data that has been de-identified and information that is publicly available, for example, government records or content a consumer has voluntarily made public.

The law does not enumerate specific categories of personal data, but common examples collected by websites and apps include names, email addresses, phone numbers, IP addresses, device identifiers, and browsing history.

Sensitive Data

A distinct subset of personal data, sensitive data triggers stronger protections under the CPA and requires opt-in consent before a controller may collect, process, or sell it. The CPA classifies the following as sensitive data:

• Data revealing racial or ethnic origin
• Data revealing religious beliefs
• Data revealing mental or physical health conditions or diagnoses
• Data concerning sex life or sexual orientation
• Data revealing citizenship or citizenship status
  
• Genetic data
• Biological data, including neural data
• Biometric data processed for the purpose of uniquely identifying an individual
• Personal data belonging to a known child
• Precise geolocation data
  

HB 24-1058, effective in August 2024, added biological data and neural data to the definition of sensitive data. Neural data is information generated by measuring the activity of an individual’s central or peripheral nervous systems.

As of July 1, 2025, biometric data protections were significantly strengthened by HB 24-1130, which imposed new consent, notice, retention, and deletion obligations on entities — including employers — that collect biometric identifiers from individuals in Colorado.

SB 25-276, which Governor Polis signed on May 23, 2025, added precise geolocation data to the category of sensitive data. The change was in force by October 1, 2025. Controllers must obtain consent before processing precise geolocation data, and the CPA now also prohibits selling any sensitive data without consent.

Controller and Processor

A controller is any person or organization that determines the purposes and means of processing personal data. A processor is a person that processes personal data on behalf of the controller. Processors must follow controllers’ instructions and support their compliance obligations. 

Before processing begins, controllers must enter into written contracts with processors that detail processing instructions, data security obligations, the conditions for engaging subcontractors, and requirements for deletion or return of data at the end of the contract.

Consent

The CPA defines consent as a clear, affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to the processing of their personal data. Acceptance of broad terms of service, hovering over or closing content, and consent obtained through dark patterns do not meet this standard.

Sale of Personal Data

A sale under the CPA is broadly defined as the exchange of personal data for monetary or other valuable consideration by a controller to a third party. Sharing data with processors, affiliates, or third parties in the course of providing a requested product or service is not considered a sale under the law.

Targeted Advertising

The CPA defines targeted advertising as displaying ads to a consumer based on personal data obtained or inferred over time from the consumer’s activities across unaffiliated websites, applications, or services, used to predict preferences or interests. Contextual advertising based on a consumer’s current search query or website visit does not fall within this definition.

Who Must Comply with the Colorado Privacy Act?

The CPA applies to any person or business that conducts business in Colorado or targets commercial products or services to Colorado residents, and that meets one or both of the following thresholds:

• Controls or processes the personal data of 100,000 or more consumers in a calendar year
• Controls or processes the personal data of at least 25,000 consumers per year, and derives revenue or receives a discount on goods or services from the sale of that data

Businesses that collect or process biometric data or the personal data of minors are subject to CPA obligations now regardless of whether they meet these thresholds.

Colorado does not require a minimum annual revenue figure for compliance, which distinguishes it from California’s CCPA. A business need not have a physical presence in Colorado for the CPA to apply; operating a website or app that is intentionally targeted at Colorado residents is sufficient.

CPA Exemptions

Certain categories of organizations and data are exempt from CPA requirements. Exempt businesses include: 

• Covered entities and business associates under HIPAA
• State institutions of higher education
• National securities associations
• Air carriers
• Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA)

Exempt categories of data include:

• Employment records
• Research data
• De-identified data
• Data maintained by public utilities, where used as authorized by state and federal law

Notably, nonprofit organizations and small businesses are not categorically exempt. If they meet the coverage thresholds and do not otherwise qualify for an enumerated exemption, they must comply.

Consumer Rights Under the Colorado Privacy Act

Colorado residents have five core rights under the CPA, which controllers must be equipped to honor.

• Right of access: Consumers may request confirmation of whether a controller is processing their data, and may obtain a copy of that data.
• Right to correction: Consumers may request that a controller correct inaccuracies in their personal data, taking into account the purpose of the processing.
• Right to deletion: Consumers may request deletion of their personal data, subject to certain exceptions.
• Right to data portability: Consumers may request their personal data in a portable, readily usable format that allows them to transmit it to another entity.
• Right to opt out: Consumers may opt out of the processing of their personal data for purposes of targeted advertising, sale, or profiling that produces legal or similarly significant effects.

Handling Consumer Rights Requests Under the CPA

The CPA also gives consumers the right to appeal a controller’s denial of a request. Controllers must respond to an authenticated consumer request within 45 days, with an option to extend by an additional 45 days where reasonably necessary. If a request is denied, the controller must inform the consumer of the available appeals process and of their right to contact the Attorney General.

What the Colorado Privacy Act Means for Cookies and Website Tracking

The CPA does not address cookies or tracking technologies by name, but its definition of personal data encompasses the types of identifiers, such as IP addresses, device IDs, browser fingerprints, and behavioral profiles, that tracking cookies and pixels routinely collect.

Because the CPA requires controllers to provide visitors with the ability to opt out of data processing for targeted advertising and sale, any cookie or tracker on your website that collects personal data for these purposes must be brought under the visitor’s control. 

In practical terms, this means deploying a consent management solution that presents Colorado consumers with a clear opt-out mechanism, honors Global Privacy Control (GPC) signals, which the Colorado Attorney General recognizes as a valid universal opt-out mechanism, and maintains records of visitors’ preferences.

Your privacy notice must also disclose the categories of personal data collected through cookies and trackers, the purposes for which that data is processed, and the categories of third parties with whom it is shared. 

If your marketing stack includes advertising pixels, session replay tools, or behavioral analytics trackers, each constitutes a data processing activity that requires transparency and, where the data is sensitive or the purpose constitutes a secondary use, opt-in consent.

Manage Colorado Privacy Act Compliance with Cookiebot by Usercentrics

Cookiebot by Usercentrics automatically scans your website for cookies and trackers, generates a cookie declaration to support compliance, and delivers a customizable consent banner that enables Colorado visitors to exercise their opt-out rights. 

The platform supports Global Privacy Control recognition (opt-out mechanisms are now required by a dozen states), granular consent logging, and automated updates as privacy laws evolve.

Controllers’ Obligations Under the Colorado Privacy Act

Beyond honoring consumer rights requests, the CPA imposes seven affirmative duties on data controllers.

Duty of Transparency

Controllers must publish a privacy notice that is reasonably accessible, clear, and meaningful. The notice must identify: 

• Categories of personal data collected
• Purposes of processing
• Categories of third parties with whom data is shared
• Mechanism through which consumers can exercise their rights

For businesses operating apps, the notice must also be posted on download pages and in the app’s settings menu. Per the 2023 CPA Rules, the link to the notice must include the word “privacy,” and the notice must be accessible to visitors with disabilities.

Duty of Purpose Specification and Data Minimization

Controllers must specify the purposes for which personal data is collected, and they may only collect data that is adequate, relevant, and limited to what is reasonably necessary for those stated purposes. 

This data minimization requirement differs from California’s CCPA, the original version of which did not include a data minimization requirement. This was added by the California Privacy Rights Act (CPRA), which took effect in January 2023.

Duty to Avoid Secondary Use

Personal data collected for one stated purpose may not be processed for a materially different purpose without first notifying the consumer of the new purpose and obtaining their consent. This is the secondary use prohibition.

Duty of Care and Data Security

Controllers must implement reasonable security measures appropriate to the volume, scope, and sensitivity of the personal data processed. The CPA does not specify minimum technical controls. It requires practices appropriate to the volume, scope, and nature of the personal data processed and the nature of the business, so the more data a controller handles, or the more sensitive it is, the stronger its safeguards should be.

Duty to Avoid Unlawful Discrimination

Controllers may not process personal data in a manner that violates state or federal anti-discrimination laws.

Data Protection Impact Assessments (DPIAs)

Controllers must conduct and document Data Protection Impact Assessments (DPIAs) for processing activities that present a heightened risk of consumer harm. These activities include targeted advertising, the sale of personal data, the processing of sensitive data, and profiling that could produce decisions with legal or similarly significant effects. 

DPIAs must be made available to the Attorney General upon request. Under SB 24-041 (effective October 1, 2025), controllers that offer online services to consumers they actually know, or willfully disregard, are minors must conduct DPIAs where those services present a heightened risk of harm to minors. Under the CPA rules, assessment documentation must be kept for as long as the processing continues and for at least three years afterward.

Consent for Sensitive Data, Children, and Secondary Use

The CPA’s opt-out default shifts to an opt-in requirement in four data processing situations:

• Sensitive data
• Personal data of a known child under 13 (for which parental or guardian consent is required)
• Personal data of a minor under 18, when used for targeted advertising, sale, or profiling
• Data for secondary purposes

The fourth situation applies from October 1, 2025. Where a controller actually knows or willfully disregards that a consumer is a minor, it must obtain consent before processing the minor’s personal data for targeted advertising, sale, or profiling. For a minor under 13, the consent comes from a parent or guardian.

Universal Opt-Out and the Global Privacy Control

The CPA was among the first U.S. state privacy laws to require controllers to recognize universal opt-out mechanisms, and controllers have had to honor them since July 1, 2024. As of 2026, 12 states require this. Colorado, along with California and Connecticut, has formally recognized the Global Privacy Control as a valid mechanism. The GPC is a browser-level signal that transmits a visitor’s opt-out preference across all sites they visit.

Controllers must honor valid GPC signals from Colorado visitors. Under the CPA rules, a universal opt-out mechanism must reflect the consumer’s affirmative choice, so a signal that a browser or operating system enables by default does not qualify.

2025 CPA Updates: Biometrics, Minors, and Geolocation

The Colorado Privacy Act has been actively amended since going into effect. Businesses subject to the CPA should note the following changes, and stay up to date on future amendments and other relevant legislation that affects personal data and privacy, such as that targeting AI governance.

Biometric Data

HB 24-1130 substantially expanded the CPA’s treatment of biometric data. Under the biometric amendment, controllers, which includes employers collecting biometric identifiers from employees and job applicants, must provide advance notice of biometric data collection, obtain consent before collection in most circumstances, maintain a written retention and destruction schedule, and implement an incident-response protocol for biometric data breaches. 

The amendment imposes obligations that apply regardless of whether the individuals involved qualify as “consumers” under the base CPA.

Minor Protections

SB 24-041 added a broader set of online safety obligations for businesses whose services are directed at or knowingly used by minors. The obligations, which came into effect on October 1, 2025, require controllers to:

• Use reasonable care to avoid heightened risks of harm to minors
• Obtain consent before processing a minor’s data for targeted advertising, sale, or profiling
• Refrain from using design features that significantly increase, sustain, or extend a minor’s use of a service unless the minor has consented
• Refrain from collecting a minor’s precise geolocation data unless it is reasonably necessary to provide the service, collect it only for as long as needed, and signal to the minor while it is being collected

On October 8, 2025, the Colorado Department of Law adopted rules implementing these amendments, clarifying the “willful disregard” standard and the definition of addictive design features.

Precise Geolocation as Sensitive Data

SB 25-276, signed May 23, 2025, amended the CPA to classify precise geolocation data as sensitive data. The bill defines the term as information that identifies the present or past location of a device linkable to an individual within a radius of 1,850 feet. Controllers must obtain consent before processing precise geolocation data, and the amendment also bars them from selling any sensitive data without consent.

Colorado's Automated Decision-Making Technology Act

Colorado has also enacted what was originally the first comprehensive state law regulating artificial intelligence systems used in consequential decisions, SB 24-205, passed in 2024. That framework was subsequently repealed and reenacted by SB 26-189, the Automated Decision-Making Technology (ADMT) Act, which Governor Jared Polis signed into law on May 14, 2026.

SB 26-189 takes effect January 1, 2027, superseding SB 24-205's June 30, 2026 effective date entirely. The new law narrows the earlier framework considerably: it drops the duty-of-care, risk-management-program, and impact-assessment requirements in favor of a pre-use notice to consumers, a post-adverse-outcome disclosure obligation, and a limited set of consumer rights tied to "covered ADMT."

The law applies to developers and deployers of covered ADMT used to materially influence consequential decisions in areas including employment, housing, lending, insurance, health care, education, and government services. Enforcement authority rests solely with the Colorado Attorney General. The AG’s office filed draft implementing rules on August 11, 2026, released a revised draft on October 6, 2026, and has scheduled a formal rulemaking hearing for October 26, 2026. The rules are due by January 1, 2027.

Colorado Privacy Act Enforcement and Penalties

The Colorado Attorney General and District Attorneys share exclusive enforcement authority under the CPA. Colorado residents have no private right of action, meaning they cannot file lawsuits directly against companies for CPA violations.

Violations of the CPA are classified as deceptive trade practices under the Colorado Consumer Protection Act, which governs the penalty structure. Civil penalties can reach USD 20,000 per violation in standard cases, and USD 50,000 per violation when the affected party is an elderly individual.

The CPA originally required the Attorney General or a District Attorney to issue a notice of violation and allow 60 days to cure before initiating enforcement. That general cure period expired on January 1, 2025, so the Attorney General may now pursue most violations without first offering a chance to cure. A 60-day cure period continues to apply to violations of the minors’ provisions until December 31, 2026.

How the CPA Compares to Other Privacy Laws

The CPA is closely modeled on Virginia’s Consumer Data Protection Act, but the laws differ in consent models, thresholds, penalties, cure periods, and opt-out signal requirements, as the table below shows, comparing the CPA with several comparable states' laws.

How to Comply with the Colorado Privacy Act: Seven Steps

Businesses that meet the CPA’s coverage thresholds should work through the following compliance steps.

Audit your data flows

Identify all personal data your organization collects, the sources and purposes, the processors involved, and the third parties with whom data is shared.

Publish a compliant privacy notice

Your notice should identify the categories of data collected, purposes of processing, third-party data sharing, and the method for consumers to exercise their rights.

Implement an opt-out mechanism

Provide consumers with a clear means to opt out of targeted advertising, data sales, and profiling. Honor Global Privacy Control signals automatically.

Obtain consent where required

Deploy a consent management solution to collect valid opt-in consent for sensitive data processing, secondary uses, and data belonging to children under 13. For visitors under 18, obtain consent before processing their data for advertising, sale, or profiling purposes.

Enter into data processing agreements

Execute written contracts with all processors before processing begins, covering the specific requirements set out in the CPA.

Build a consumer request process

Establish a documented system for receiving, authenticating, and responding to consumer rights requests within 45 days, with an appeals pathway.

Conduct and document DPIAs

Complete Data Protection Impact Assessments for high-risk processing activities and retain documentation for at least three years.