Colorado Data Removal Guide (2026)
Colorado's comprehensive privacy law, effective July 2023, requires covered controllers to honor valid universal opt-out mechanisms, including browser-level Global Privacy Control signals, for covered processing.
Research status: this is a dated state-law snapshot; verify the current official sources before relying on a right, deadline, penalty, or complaint route.
This page is educational orientation, not legal advice. Scope, exemptions, deadlines, penalties, regulator powers and broker routes can change. Verify the current statute and state regulator guidance before relying on a right or deadline.
At a glance
- Comprehensive state privacy law
- Recorded: CPA
- Broker response deadline
- 45 days in this research snapshot for qualifying requests; extensions and exemptions may apply
- Enforcement
- Colorado Attorney General
Colorado Privacy Act (CPA)
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data, subject to the statute and exceptions. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado requires covered controllers to recognize qualifying universal opt-out mechanisms, including recognized GPC signals. Enforcement is via the Attorney General and district attorneys. The general 60-day cure provision sunset on January 1, 2025, but a limited 60-day notice-and-cure rule for specified provisions remains through December 31, 2026; current notice and enforcement steps still depend on the statute and the enforcing authority.
Read the full CPAexplainer →Scope, thresholds, exceptions, cure rules, and enforcement details where documented.
What rights do Colorado residents have?
- →Right to deletion (§ 6-1-1306)
- →Right to opt out via universal opt-out mechanisms (GPC)
- →Right to opt out of sale and targeted advertising
- →Right to appeal denials
- →AG + DA enforcement; no private right of action
Where does your data leak from in Colorado?
The FTC explains that people-search sites may combine public records, public social profiles, and information from other brokers. The examples below are a research snapshot, not an exhaustive or person-specific source map for Colorado:
- Denver, El Paso County property records
- Colorado Judicial Branch case search
- Colorado DMV driver records
- Colorado SOS business filings
Generate requests in under 60 seconds
Explore 1,034 US/global data brokers
What if a broker ignores your request?
If a qualifying request does not receive a response within the applicable window, review the current extension and exemption rules, then consider the Colorado Attorney General complaint route. The authority's jurisdiction and available remedies vary.
File a complaint with Colorado Attorney General ↗FAQ: Colorado data removal
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
The general 60-day cure provision sunset on January 1, 2025, but a limited 60-day notice-and-cure rule for specified provisions remains through December 31, 2026. That does not establish a guaranteed investigation or penalty timeline; review the current statute, rules, and notice issued by the Attorney General or district attorney for the matter at issue.