What Is the Colorado Privacy Act?
The Colorado Privacy Act covers controllers processing personal data of 100,000+ Colorado consumers or 25,000+ while selling data. Residents have rights to access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. Colorado is one of few states mandating recognition of universal opt-out mechanisms (GPC). Enforcement is via the Attorney General and district attorneys. The 60-day cure period that existed until January 2025 has now sunsetted, violations are immediately enforceable.
At a glance
- Full name
- Colorado Privacy Act
- Short code
- CPA
- Effective date
- July 1, 2023
- Response deadline
- 45 days
- Cure period
- None (sunset)
- Private right of action
- No
- Enforcement
- Colorado Attorney General
- Maximum penalty
- Up to $20,000 per violation under the Colorado Consumer Protection Act
- Statutory citation
- Colo. Rev. Stat. § 6-1-1301 et seq.
Who CPA applies to
A business is covered if it meets the applicability thresholds set out in Colo. Rev. Stat. § 6-1-1301 et seq.. Most state laws use an “or” framework — any one of the thresholds triggers coverage unless otherwise noted.
- Controls or processes personal data of 100,000+ Colorado consumers in a calendar year, OR
- Derives revenue or receives a discount from the sale of personal data AND processes data of 25,000+ Colorado consumers
Consumer rights under CPA
Right to deletion (§ 6-1-1306)
Right to opt out via universal opt-out mechanisms (GPC)
Right to opt out of sale and targeted advertising
Right to appeal denials
AG + DA enforcement; no private right of action
Notable features (vs. CCPA)
The CPA is notable for formally recognizing a universal opt-out mechanism (UOOM), meaning Colorado was among the first states to require businesses to honor browser-based signals like Global Privacy Control (GPC). The Colorado AG publishes a list of approved UOOMs. CPA also mandates a privacy notice, data protection assessments, and explicit opt-in consent for sensitive data.
Enforcement & penalties
Enforcing agency: Colorado Attorney General
Maximum penalty: Up to $20,000 per violation under the Colorado Consumer Protection Act
Cure period: The 60-day cure period sunset on January 1, 2025. Violations occurring after that date are directly enforceable without a cure opportunity.
Private right of action: The CPA has no private right of action. Enforcement is shared between the Colorado AG and district attorneys.
Where to file a complaint: Colorado Attorney General
How to exercise your CPA rights
- 1
Identify the business that holds your data (or use OfflistMe, which pre-targets 500+ known brokers and applies CPA citations automatically).
- 2
Submit a verifiable consumer request to the business's designated contact. Include enough identifying data that the business can verify you as a Colorado resident (e.g., ZIP code, email associated with your record).
- 3
Under CPA, businesses have 45 days to respond. Extensions are permitted with written notice under most state laws.
- 4
If the business fails to respond or denies the request without legal basis, file a complaint with the Colorado Attorney General at https://complaints.coag.gov.
Use your rights
CPA-compliant deletion emails, $7 one-time
OfflistMe drafts CPA-compliant deletion emails for $500+ data brokers. Citations included. You send from your own inbox. No account, no ID upload.
Start for $7 →FAQ
Does Global Privacy Control work in Colorado?+
Yes. Colorado is one of the states that requires businesses to honor GPC browser signals as a legal opt-out of sale and targeted advertising. Enabling GPC in your browser adds a second layer of opt-out beyond individual deletion requests.
Is there still a cure period under Colorado CPA?+
No. The 60-day cure period sunsetted on January 1, 2025. The AG can now enforce CPA violations immediately upon discovery.
Official sources & citations
Compare with sibling state laws
CPA is one of 18 comprehensive US state privacy laws. Its closest peers by effective date, useful when tracking how this law influenced or was influenced by neighboring legislation: