What Is the Colorado Privacy Act?
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data, subject to the statute and exceptions. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado requires covered controllers to recognize qualifying universal opt-out mechanisms, including recognized GPC signals. Enforcement is via the Attorney General and district attorneys. The former 60-day cure provision sunset on January 1, 2025; current notice and enforcement steps still depend on the statute and the enforcing authority.
At a glance
- Full name
- Colorado Privacy Act
- Short code
- CPA
- Effective date
- July 1, 2023
- Response reference
- 45 days in this snapshot
- Cure period
- None recorded in this snapshot
- Private right of action
- No
- Enforcement
- Colorado Attorney General
- Penalty reference
- Up to $20,000 per violation under the Colorado Consumer Protection Act
- Statutory citation
- Colo. Rev. Stat. § 6-1-1301 et seq.
Who CPA applies to
A business is covered if it meets the applicability thresholds set out in Colo. Rev. Stat. § 6-1-1301 et seq.. The thresholds listed below are the research record for this law. Whether one or more applies depends on the current statute, its exceptions, and the business's facts; do not assume a universal threshold structure.
- Controls or processes personal data of 100,000+ Colorado consumers in a calendar year, OR
- Derives revenue or receives a discount from the sale of personal data AND processes data of 25,000+ Colorado consumers
Consumer rights under CPA
Right to deletion (§ 6-1-1306)
Right to opt out via universal opt-out mechanisms (GPC)
Right to opt out of sale and targeted advertising
Right to appeal denials
AG + DA enforcement; no private right of action
Notable features (vs. CCPA)
The CPA is notable for formally recognizing a universal opt-out mechanism (UOOM), meaning Colorado was among the first states to require businesses to honor browser-based signals like Global Privacy Control (GPC). The Colorado AG publishes a list of approved UOOMs. CPA also mandates a privacy notice, data protection assessments, and explicit opt-in consent for sensitive data.
Enforcement and penalty reference
Enforcing agency: Colorado Attorney General
Penalty reference: Up to $20,000 per violation under the Colorado Consumer Protection Act
Cure period: The 60-day cure period sunset on January 1, 2025. Violations occurring after that date are directly enforceable without a cure opportunity.
Private right of action: The CPA has no private right of action. Enforcement is shared between the Colorado AG and district attorneys.
Where to file a complaint: Colorado Attorney General
How to exercise your CPA rights
- 1
Identify the business that holds your data. OfflistMe can help you review a provider route across 1,034 US/global workflow profiles in the 1,052-record research universe; it does not decide whether a law applies to a specific request.
- 2
Submit a request to the business's designated contact using the provider's current verification instructions. Include only the information reasonably needed to match your record and check the applicable Colorado residency, scope, exemption, and verification rules before sending.
- 3
This research snapshot records a 45-day reference window for the modeled request. Confirm the current statute, request type, controller scope, extension rule, and verification date before treating it as a deadline.
- 4
If the provider does not respond or disputes the request, preserve the request and response record, review the applicable exceptions, and consider the Colorado Attorney General complaint route at https://complaints.coag.gov. A complaint route does not itself guarantee deletion or a particular enforcement result.
Generate requests in under 60 seconds
Generate a CPA privacy request, $9 one-time
FAQ
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
The general 60-day cure provision sunset on January 1, 2025. That does not establish a guaranteed investigation or penalty timeline; review the current statute, rules, and notice issued by the Attorney General or district attorney for the matter at issue.
Official sources & citations
Compare with sibling state laws
CPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: