Colorado Data Removal Guide (2026)
Colorado was the third US state with a comprehensive privacy law. The CPA, effective July 2023, is distinctive for requiring controllers to honor "universal opt-out mechanisms", browser-level Global Privacy Control signals, as legally binding opt-out requests.
At a glance
- Comprehensive state privacy law
- Yes, CPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Colorado Attorney General
- Residents
- 5.8M (approx.)
Colorado Privacy Act (CPA)
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado is one of few states mandating recognition of universal opt-out mechanisms (GPC). Enforcement is via the Attorney General and district attorneys. The 60-day cure period that existed until January 2025 has now sunsetted, violations are immediately enforceable.
Read the full CPA explainer →Thresholds, penalties, cure period, private right of action, enforcement history.
What rights do Colorado residents have?
- →Right to deletion (§ 6-1-1306)
- →Right to opt out via universal opt-out mechanisms (GPC)
- →Right to opt out of sale and targeted advertising
- →Right to appeal denials
- →AG + DA enforcement; no private right of action
Where does your data leak from in Colorado?
Data brokers don’t guess your address — they scrape specific public-record sources. The ones most relevant in Colorado:
- Denver, El Paso County property records
- Colorado Judicial Branch case search
- Colorado DMV driver records
- Colorado SOS business filings
Ready to remove
Opt out of 500+ brokers for $7
OfflistMe drafts a legally compliant deletion email citing CPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $7 →What if a broker ignores your request?
If a broker does not respond within 45 days, file a complaint with the Colorado Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Colorado Attorney General ↗FAQ: Colorado data removal
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
No. The 60-day cure period sunsetted on January 1, 2025. The AG can now enforce CPA violations immediately upon discovery.