Colorado Data Removal Guide (2026)
Colorado's comprehensive privacy law, effective July 2023, requires covered controllers to honor valid universal opt-out mechanisms, including browser-level Global Privacy Control signals, for covered processing.
Research status: published state guide pending fresh official-source re-verification.
This page is educational orientation, not legal advice. Scope, exemptions, deadlines, penalties, regulator powers and broker routes can change. Verify the current statute and state regulator guidance before relying on a right or deadline.
At a glance
- Comprehensive state privacy law
- Recorded: CPA
- Broker response deadline
- 45 days in this research snapshot for qualifying requests; extensions and exemptions may apply
- Enforcement
- Colorado Attorney General
Colorado Privacy Act (CPA)
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data, subject to the statute and exceptions. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado requires covered controllers to recognize qualifying universal opt-out mechanisms, including recognized GPC signals. Enforcement is via the Attorney General and district attorneys. The former 60-day cure provision sunset on January 1, 2025; current notice and enforcement steps still depend on the statute and the enforcing authority.
Read the full CPAexplainer →Scope, thresholds, exceptions, cure rules, and enforcement details where documented.
What rights do Colorado residents have?
- →Right to deletion (§ 6-1-1306)
- →Right to opt out via universal opt-out mechanisms (GPC)
- →Right to opt out of sale and targeted advertising
- →Right to appeal denials
- →AG + DA enforcement; no private right of action
Where does your data leak from in Colorado?
The FTC explains that people-search sites may combine public records, public social profiles, and information from other brokers. The examples below are a research snapshot, not an exhaustive or person-specific source map for Colorado:
- Denver, El Paso County property records
- Colorado Judicial Branch case search
- Colorado DMV driver records
- Colorado SOS business filings
Generate requests in under 60 seconds
Generate requests for 1009 US/global broker workflows for $9
What if a broker ignores your request?
If a qualifying request does not receive a response within the applicable window, review the current extension and exemption rules, then consider the Colorado Attorney General complaint route. The authority's jurisdiction and available remedies vary.
File a complaint with Colorado Attorney General ↗FAQ: Colorado data removal
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
The general 60-day cure provision sunset on January 1, 2025. That does not establish a guaranteed investigation or penalty timeline; review the current statute, rules, and notice issued by the Attorney General or district attorney for the matter at issue.