What Is the Colorado Privacy Act?
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado is one of few states mandating recognition of universal opt-out mechanisms (GPC). Enforcement is via the Attorney General and district attorneys. The 60-day cure period that existed until January 2025 has now sunsetted — violations are immediately enforceable.
At a glance
- Full name
- Colorado Privacy Act
- Short code
- CPA
- Effective date
- July 1, 2023
- Response deadline
- 45 days
- Cure period
- None (sunset)
- Private right of action
- No
- Enforcement
- Colorado Attorney General
- Maximum penalty
- Up to $20,000 per violation under the Colorado Consumer Protection Act
- Statutory citation
- Colo. Rev. Stat. § 6-1-1301 et seq.
Who CPA applies to
A business is covered if it meets the applicability thresholds set out in Colo. Rev. Stat. § 6-1-1301 et seq.. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Controls or processes personal data of 100,000+ Colorado consumers in a calendar year, OR
- Derives revenue or receives a discount from the sale of personal data AND processes data of 25,000+ Colorado consumers
Consumer rights under CPA
Right to deletion (§ 6-1-1306)
Right to opt out via universal opt-out mechanisms (GPC)
Right to opt out of sale and targeted advertising
Right to appeal denials
AG + DA enforcement; no private right of action
Notable features (vs. CCPA)
The CPA is notable for formally recognizing a universal opt-out mechanism (UOOM) — meaning Colorado was among the first states to require businesses to honor browser-based signals like Global Privacy Control (GPC). The Colorado AG publishes a list of approved UOOMs. CPA also mandates a privacy notice, data protection assessments, and explicit opt-in consent for sensitive data.
Enforcement & penalties
Enforcing agency: Colorado Attorney General
Maximum penalty: Up to $20,000 per violation under the Colorado Consumer Protection Act
Cure period: The 60-day cure period sunset on January 1, 2025. Violations occurring after that date are directly enforceable without a cure opportunity.
Private right of action: The CPA has no private right of action. Enforcement is shared between the Colorado AG and district attorneys.
Where to file a complaint: Colorado Attorney General
How to exercise your CPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 300+ known brokers and applies CPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Colorado resident (e.g., ZIP code, email associated with your record).
- 3
Under CPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Colorado Attorney General at https://complaints.coag.gov.
Use your rights
CPA-compliant deletion emails, $5 one-time
OfflistMe drafts CPA-compliant deletion emails for 300+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $5 →FAQ
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
No. The 60-day cure period sunsetted on January 1, 2025. The AG can now enforce CPA violations immediately upon discovery.
Official sources & citations
Compare with sibling state laws
CPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date — useful when tracking how this law influenced or was influenced by neighbouring legislation: