Colorado Privacy Act (CPA): An Overview

Colorado was the third U.S. state to pass privacy legislation. While it was certainly influenced by and shares content from California and Virginia’s state laws, the Colorado Privacy Act also shows the rapid evolution of legal thought and consumer rights expectations around privacy.

There is still no comprehensive federal privacy law, though Congress is weighing proposals such as the SECURE Data Act, which as introduced would preempt much of state privacy law. Until then, here is what businesses operating in Colorado need to know.

What Is the Colorado Privacy Act?

The Colorado Privacy Act (CPA) took effect on July 1, 2023. Signed in July 2021, it protects the privacy rights of Colorado residents and sets duties for companies that do business in the state, including how they collect, store, process, and maintain personal data.

Consumers, Controllers, and Processors Under the Colorado Privacy Act

The Colorado Privacy Act is designed to protect the consumer, defined in the Act as: “an individual who is a Colorado resident acting only in an individual or household context; and does not include an individual acting in a commercial or employment context, as a job applicant, or as a beneficiary of someone acting in an employment context”.

The CPA gives consumers rights over their personal data, which they exercise by making requests to controllers. Under the Act a data controller is “a person that, alone or jointly with others, determines the purposes for and means of processing personal data”. So it could be a company, but isn’t explicitly limited to commercial enterprises.

The Act defines a data processor as “a person that processes personal data on behalf of a controller”. Again, likely often a corporate entity, but not always. It can also be a third party that’s not part of the same entity that qualifies as the controller.

“Processing” with regards to data doesn’t explicitly refer to its sale, and the CPA defines that as “collection, use, sale, storage, disclosure, analysis, deletion, or modification of personal data and includes the actions of a controller directing a processor to process personal data”.

Consumer Rights Under the Colorado Privacy Act

Consumers have five specific rights under the Colorado Privacy Act:

CPA Consumer Rights

1

Right to opt out

Of targeted advertising, the sale of personal data, or profiling that produces legal or similarly significant effects.

2

Right to access

Any data that a company has collected about them.

3

Right to have any data corrected

That has been collected about them and is incorrect or outdated.

4

Right to deletion

For any data collected about them.

5

Right to data portability

The ability for a consumer to receive their data in a portable format to transfer to another entity.

Data controllers must respond to an authenticated consumer request within 45 days of receiving it. Where “reasonably necessary” the controller can request an additional 45 days to complete the request, but must communicate the reason for the delay.

Controllers must also offer a conspicuous appeal process that is as easy to use as the request process. They must answer an appeal within 45 days, extendable by 60 days when reasonably necessary, and tell the consumer they can contact the Attorney General about the result. A controller can decline a request it cannot authenticate with commercially reasonable effort, after asking for any additional information it reasonably needs.

Rights requests do not cover de-identified data. Responses are free of charge, except that a controller may charge a fee for a second or later request within 12 months, and portability requests are limited to twice a calendar year.

Unlike California’s CCPA, the CPA does not provide consumers with private right of action, i.e. the ability to sue companies for damages or injury in the event of an alleged violation.

Personal Data Under the CPA

The CPA protects personal data, which it defines as information “linked or reasonably linkable to an identified or identifiable individual”. The statute lists no specific data types, so anything that can reasonably be tied to a person can qualify. De-identified data and publicly available information are excluded.

Sensitive Data

The CPA also defines sensitive data, which a controller may not process or sell without consent. It includes:

• Personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship status
• Genetic or biometric data that may be processed to uniquely identify an individual
• Personal data from a known child, meaning a child under 13
• Biological data, including neural data
• Precise geolocation data, meaning location within a radius of 1,850 feet

Consent Under the CPA

The CPA relies on opt-out for most processing, so controllers generally do not need consent before collecting personal data. Consent is required to process or sell sensitive data (a parent’s or guardian’s consent for a known child), and to process personal data for a secondary purpose that is not reasonably necessary to or compatible with the purposes the controller specified.

Since July 1, 2024, controllers that sell personal data or process it for targeted advertising must honor a user-selected universal opt-out mechanism that meets the Attorney General’s specifications.

Other privacy laws, like the EU’s General Data Protection Regulation (GDPR), takes a different approach: processing needs a lawful basis, and consent is only one of several. In the U.S., newer laws increasingly mix opt-out and opt-in rules, as Colorado’s sensitive data and minors’ provisions show

Who Has to Comply with the Colorado Privacy Act?

The CPA applies to businesses that conduct business in Colorado, or intentionally target products or services to Colorado residents, and that meet one of two thresholds:

• Control or process the personal data of 100,000 or more consumers in a calendar year
• Control or process the personal data of 25,000 or more consumers and derive revenue, or receive a discount on goods or services, from selling personal data

Two sets of rules apply at any volume: the biometric identifier rules and the minors’ data rules. Colorado has no revenue-only test, unlike California’s CCPA. Its second threshold is lower than Virginia’s, because any revenue or discount from selling personal data counts, not just a majority share of revenue.

Exemptions to Colorado Privacy Act Compliance Requirements

Many CPA exemptions cover specific data rather than whole organizations. Three types of entity are exempt:

• Air carriers
• National securities associations
• Financial institutions and their affiliates that are subject to the Gramm-Leach-Bliley Act (GLBA)

The CPA also does not apply to:

• Protected health information held by HIPAA covered entities and business associates, plus certain other health care and research data
• Personal data regulated by the Gramm-Leach-Bliley Act, the Driver’s Privacy Protection Act, the Family Educational Rights and Privacy Act, or the Children’s Online Privacy Protection Act (COPPA) (when handled in compliance)
• Activity regulated by the Fair Credit Reporting Act, including consumer reporting agencies
• Data maintained for employment records
• Customer data held by public utilities
• Data that the state, its courts, counties, and municipalities, or state institutions of higher education maintain for noncommercial purposes as authorized by law

Narrower exemptions are in C.R.S. 6-1-1304(2). Unlike many state laws, the CPA applies to nonprofits that meet the thresholds, and the higher education exemption covers only state institutions.

Companies’ Obligations Under the Colorado Privacy Act

On the other side of the scale from consumers’ rights under the CPA, businesses have responsibilities regarding collecting and use of data.

CPA Obligations

Duty of transparency

Must provide a “reasonably accessible, clear, and meaningful privacy notice.”

Duty of purpose specification

What data is being collected and for what specific purposes.

Duty of data minimization

Adequate, relevant, and limited to what is reasonably necessary to fulfill the communicated purpose

Duty to avoid secondary use

Do not process personal data for purposes that are not reasonable or necessary to the communicated purpose.

Duty of care

Reasonable measures to secure data from unauthorized access must be taken for storage and use.

Duty to avoid unlawful discrimination

Do not process personal data in violation of state or federal laws prohibiting unlawful discrimination against consumers.

Duty regarding sensitive data

Do not process or sell sensitive data without consent, or, for a known child, without a parent’s or guardian’s consent.

Transparency Requirements for Privacy Notices

Further to the duty of transparency, the privacy notice must include:

• Categories of personal data collected or processed by the controller or processor
• Purposes for which the categories of data are processed
• Categories of personal data that the controller shares with third parties, if any
• Categories of third parties with which the controller shares personal data, if any
• Clear and conspicuous disclosure of the sale or processing of personal data if the controller sells it to third parties or processes it for targeted advertising, as well as how consumers can exercise their right to opt out of sale or processing
• How and where consumers can exercise their rights under the Act, including contact information for the controller and information about appealing a controller’s action with regards to consumer requests (though consumers cannot be required to create a new account to make or appeal the response to a request)

Controllers must also conduct and document a data protection assessment before processing that presents a heightened risk of harm, such as targeted advertising, sale, certain profiling, processing sensitive data and, since October 1, 2025, online services offered to minors. The Attorney General can request these assessments, which are confidential and exempt from public records requests.

Companies do have to respond to consumer requests within 45 days, with some exceptions and with the possibility of extending that in some cases. They must also explain the reason for the need for an extension, or the reason for denial of fulfilling a request.

A controller can decline a request when it holds no data about the consumer or cannot authenticate the request. It must explain why and how to appeal.

Amendments to the Colorado Privacy Act Since 2024

The CPA has been amended several times, and every change below is in force:

• Attorney General rules (finalized October 2025): The rules explain when a controller “willfully disregards” that a consumer is a minor, and they align the definition of “revealing” with the geolocation change.
• Biological and neural data (HB 24-1058, effective August 7, 2024): Both are now sensitive data.
• Biometric data (HB 24-1130, effective July 1, 2025): Any controller that handles biometric identifiers, at any volume, must adopt a written retention and deletion policy, give notice and obtain consent before collecting a biometric identifier, and may not sell it. Employers face added limits on when they can require consent.
• Minors’ data (SB 24-041, effective October 1, 2025): Controllers that offer an online service to a consumer they know or willfully disregard is under 18 must use reasonable care to avoid heightened risk of harm and conduct data protection assessments. Without consent (a parent’s for children under 13), they may not process a minor’s data for targeted advertising, sale, or profiling, or use design features to extend a minor’s use of the service.
• Precise geolocation (SB 25-276, effective May 23, 2025): Location within 1,850 feet is sensitive data. Controllers need consent to process or sell it, and consent is now required to sell any sensitive data.

Colorado Privacy Act Enforcement and Penalties

The Colorado Attorney General’s Office and district attorneys have exclusive authority to enforce the CPA, and consumers cannot sue under it. Controllers can ask the Attorney General for interpretive guidance and opinion letters. If a CPA violation is alleged and appears reasonable or provable, the Attorney General’s office will send a notice to the organization in question with an option to correct the problem.

Businesses once had 60 days to cure a violation before enforcement. That general cure period ended on January 1, 2025, so the Attorney General and district attorneys can now pursue most violations without first offering a chance to cure. For violations of the minors’ data provisions, a 60-day cure notice remains required through December 31, 2026.

The CPA sets no fines of its own. A violation counts as a deceptive trade practice under the Colorado Consumer Protection Act, which allows civil penalties of up to USD 20,000 per violation, or up to USD 50,000 per violation where the victim is elderly. The Act’s former USD 500,000 cap on a series of violations was removed in 2019.

What Does the Colorado Privacy Act Mean for Websites?

The CPA has applied since July 1, 2023, so any business that meets its thresholds is already covered. Programs built for California, Virginia, or the GDPR will have covered much of the same ground, but Colorado’s newer rules on opt-out signals, geolocation, biometrics, and minors’ data may call for a fresh review.

That said, regular data audits, risk assessments and reviews of privacy policies and operations are highly recommended, as is consulting with qualified legal counsel, and appointing a data protection officer, where possible.

Companies also need to make it reasonably easy for consumers to contact them, and to be able to respond to and comply with consumer requests in a timely manner. Such requests could be resource-intensive and time-consuming to smaller organizations, especially if not automated, and if the companies’ data is stored in multiple locations.

Companies engaging in digital marketing, ecommerce and other online activities should look into a consent management platform for their web and app properties to support the collection of consumers’ consents where required, as well as storing them securely, and in case of an audit or allegation of privacy violation.

In practice, this means configuring a consent management platform to recognize GPC signals automatically, keep records of consent choices, and route opt-out requests without manual intervention.

Ongoing Support for the CPA

The CPA keeps evolving. It has been amended several times since 2024, and the Attorney General has updated its rules to match. Businesses that have prepared for other U.S. state laws will have a head start, but should still check the differences above. Usercentrics Web CMP and App CMP can help you deliver the notices and opt-outs the CPA requires, including recognition of universal opt-out signals such as GPC, and adapt as the rules change.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.