Colorado Privacy Act: CPA Compliance
What is the CPA?
The Colorado Privacy Act (CPA), effective from July 1, 2023, aims to protect the personal data of Colorado residents. It imposes compliance responsibilities on businesses operating in the state. These businesses must provide clear notices about data collection practices and offer opt-out options for data processing.
Visit the common CPA questions and answers
COMPLIANCE
How to comply with the Colorado data privacy law
The CPA includes specific thresholds and consumer rights, such as the right to opt out of data sales and targeted advertising, as well as rights to access, correct, and delete personal data, and data portability. The CPA also mandates opt-in consent for processing sensitive data and imposes stricter data minimization requirements.
RISKS
What are the consequences of CPA noncompliance?
Fines not specified under the CPA, penalties governed by the Colorado Consumer Protection Act- from USD 2,000 to USD 20,000 per violation, or between USD 10,000 to USD 50,000 per violation against an elderly person- 60-day cure period (sunsets January 1, 2025).
Updates to the CPA for 2025 brought changes to companies’ compliance requirements and the sunsetting of the regulation’s required cure period. Penalties range from USD 2,000 to USD 20,000 per violation or between USD 10,000 to USD 50,000 per violation against an elderly person.
your questions answered
Contact our expert team
We’re happy to answer questions about data privacy, compliant marketing operations, and the CPA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
- Interested in how privacy compliance benefits user experience and your marketing strategies?
- Not sure if your business is privacy-compliant in Colorado?
- Need clarity on what your company’s compliance responsibilities are?
- Looking to partner with us?
Learn more
Frequently asked questions
What are consumer rights under the CPA?
Under the Colorado Privacy Act, consumers have five specific rights:
- Right to access: any personal data that a company has collected about them
- Right to opt out: of data processing for targeted advertising, sale or profiling using their personal data
- Right to correction: any personal data that has been collected about them and is incorrect or outdated
- Right to deletion: any personal data that has been collected about them
- Right to data portability: to receive the personal data a company has about them in a readily portable format that can be transferred to another entity
What are the penalties for CPA noncompliance?
The Colorado Attorney General enforces the CPA, and provides for a 60-day cure period. Penalties for CPA violations fall under deceptive trade practices, governed by the Colorado Consumer Protection Act. Fines can be from USD 2,000 to USD 20,000 per violation, or between USD 10,000 to USD 50,000 per violation against an elderly person.
What is CPA compliance software?
CPA compliance software enables businesses to meet the requirements of the Colorado privacy law, like providing consumers with information about data processing and exercising their rights, and obtaining consent where required.
Can a consent management platform enable CPA compliance?
A consent management platform (CMP) is a type of CPA compliance software that enables companies to achieve and maintain CPA privacy compliance for websites and apps. A CMP’s banners present users with information about what cookies and other trackers are in use that collect personal information. They enable users to make informed and granular consent choices. They also securely store and document consent information over time, which users can update.