Colorado Data Removal Guide (2026)
Colorado was the third US state with a comprehensive privacy law. The CPA, effective July 2023, is distinctive for requiring controllers to honor "universal opt-out mechanisms" — browser-level Global Privacy Control signals — as legally binding opt-out requests.
At a glance
- Comprehensive state privacy law
- Yes — CPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Colorado Attorney General
- Residents
- 5.8M (approx.)
Colorado Privacy Act (CPA)
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado is one of few states mandating recognition of universal opt-out mechanisms (GPC). Enforcement is via the Attorney General and district attorneys. The 60-day cure period that existed until January 2025 has now sunsetted — violations are immediately enforceable.
Your rights
- →Right to deletion (§ 6-1-1306)
- →Right to opt out via universal opt-out mechanisms (GPC)
- →Right to opt out of sale and targeted advertising
- →Right to appeal denials
- →AG + DA enforcement; no private right of action
Where your data leaks from in Colorado
Data brokers don\u2019t guess your address \u2014 they scrape specific public-record sources. The ones most relevant in Colorado:
- Denver, El Paso County property records
- Colorado Judicial Branch case search
- Colorado DMV driver records
- Colorado SOS business filings
Ready to remove
Opt out of 200+ brokers for $2
OfflistMe drafts a legally compliant deletion email citing CPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $2 \u2192If a broker ignores your request
If a broker does not respond within 45 days, file a complaint with the Colorado Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Colorado Attorney General \u2197FAQ: Colorado data removal
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
No. The 60-day cure period sunsetted on January 1, 2025. The AG can now enforce CPA violations immediately upon discovery.