Colorado Privacy Act

Three documents make the Colorado law

Colorado’s law is not only the statute. The Act told the Attorney General to write rules, including the technical specification for a universal opt-out mechanism, and the rules then told the Department of Law to keep a public list of the mechanisms it recognises. A privacy lead working a Colorado question usually needs all three sheets.

The rules carry most of the operational detail: the wording of an opt-out link, what a privacy notice must list, the thirteen things an assessment must record, and how a site treats a browser signal. The Department has proposed amendments since, the latest filed in July 2025 to reflect two later bills (see the 2025 rulemaking), so check the current Code of Colorado Regulations before quoting a rule number to a regulator. To see which other state laws reach the same business, run the which privacy laws apply checker.

Who is inside, nonprofits included

A controller is inside when it passes two gates. First, it conducts business in Colorado or produces or delivers commercial products or services intentionally targeted to Colorado residents (§ 6-1-1304(1)(a)). Second, it meets a volume test: ≥100,000 Colorado consumers in a calendar year; or revenue/discount from selling personal data + ≥25,000 consumers. The Attorney General’s FAQ adds that the Act applies regardless of where the controller is located.

One part skips the volume test. Since 1 October 2025 the duties toward minors (§§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5, added by S.B. 24-041) apply to any controller that conducts business in Colorado or targets its residents, whatever its count.

That clause is the first thing Colorado does differently from most of its neighbours. The exemption list in the Act as passed names no carve-out for nonprofits, and the Attorney General says so in terms. A charity, a membership association or an advocacy group with a large Colorado supporter file counts its records the same way a retailer does.

Who counts toward the 100,000

A “consumer” is a Colorado resident acting only in an individual or household context. It does not include anyone acting in a commercial or employment context, a job applicant, or a beneficiary of someone acting in an employment context (§ 6-1-1303(6)). The Attorney General’s FAQ confirms the 100,000 is Colorado residents, not people across the United States, and that job applicant data is not personal data for the threshold. A B2B software firm whose users are buyers at their desks may hold many records and still count few consumers.

What sits outside

Most of these are data-level exemptions: a clinic outside HIPAA’s reach, or a firm whose only covered data is employee files, still has to ask whether its other data passes the gates. Full text: S.B. 21-190.

The universal opt-out: GPC, and only GPC so far

Since 1 July 2024, a controller that sells personal data or uses it for targeted advertising must let Colorado consumers opt out through a user-selected universal opt-out mechanism that meets the Attorney General’s technical specification (§ 6-1-1306(1)(a)(IV)(B)). Rule 5.07 told the Department of Law to publish a list of recognised mechanisms. The list has one entry. In the Department’s words: “Currently, the only UOOM considered valid by The Department is GPC.”

Global Privacy Control is a signal a browser or extension sends with each request, as the HTTP header Sec-GPC: 1, and exposes to scripts as navigator.globalPrivacyControl. The Department adds that its list does not rule out other mechanisms; it is the set it will prioritise for enforcement.

What a site does when the signal arrives

An opt-out by signal lasts until the person consents again; the signal going quiet is not consent. Rule 5.08(E) lets a controller show the result on the page, for example “Opt-Out Preference Signal Honored”. In Colorado that display is optional.

Default-on browsers

The Act forbids a mechanism that is a default setting (§ 6-1-1313(2)(c)), and Rule 5.04 draws the line. A signal switched on by default in a browser that came pre-installed with the device or operating system does not show the person’s choice. A tool the person installed themselves, marketed as one that sends opt-out signals, does, even if the signal is on by default. The GPC site lists browsers with native support, some with the signal on by default; under Rule 5.04(B), one the person downloaded and installed counts as their choice.

Test it from the visitor’s side with the Global Privacy Control checker, which reads the signal in your own browser. Most sites wire the response through their consent tool; the consent management platform comparison shows which ones say they honour GPC.

Five signal situations, read against the rules

The rules answer most of the questions a product team asks once GPC handling reaches the backlog. Pick the situation closest to yours.

Colorado's signal rule beside California's

A firm already honouring GPC for California has most of the plumbing. The differences sit in what the signal covers and what the page must show.

Rights, and the two clocks

Colorado gives consumers five rights over personal data (§ 6-1-1306(1)):

Opt out

Of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects

Access

Confirm whether you process their data, and see it

Correct

Fix inaccuracies, given the data's nature and the purposes of processing

Delete

Personal data concerning them

Portability

A portable, readily usable copy, no more than two times per calendar year

Two clocks, two different extensions

The request clock is the familiar 45 days + 45. The appeal clock is built differently from Virginia’s flat 60 days: 45 days, plus up to 60 more. Both extensions must be announced inside the first 45 days.

A refusal also has a 45-day limit: give the reasons and the instructions for appealing. After an appeal, tell the person they can contact the Attorney General if they are unhappy with the result. The first request in any twelve months is free; for a second or later one the Attorney General’s FAQ allows 25 cents per page or no more than the actual cost. Work out the dates for a live request with the DSAR deadline calculator.

How people must be able to ask

• No one may be made to create an account to use a right (§ 6-1-1308(1)(c)(I)).
• Methods follow how people already deal with you: an online-only business that deals directly with consumers needs only an email address; a business with stores should consider offline routes too (Attorney General’s FAQ).
• An opt-out link must go straight to the method, with text such as “Your Privacy Choices” or “Your Colorado Privacy Choices” (Rule 4.03(B)(3)).
• When someone asks for several things at once, complete the opt-out first if it is quicker (Rule 4.03(A)(1)(b)).

Where Colorado asks for consent

Colorado is an opt-out law for most processing, with three places where you need consent first. Consent means a clear, affirmative act showing freely given, specific, informed and unambiguous agreement (§ 6-1-1303(5)).

The list has grown since 2021. The Attorney General’s rulemaking page says Senate Bill 25-276 adds precise geolocation data as sensitive data, and Senate Bill 24-041 adds protections for minors’ online data, in effect since 1 October 2025. Check the current statute for 25-276’s start date before relying on the enacted list above.

Consent goes stale

If someone has not interacted with you in the prior 24 months, refresh consent before you keep processing their sensitive data (Rule 7.08). You are spared the refresh where people can update their choices at any time through a settings page they control. Asking again after an opt-out has its own limit: no interface-dominating cookie banners, cookie walls, high-frequency requests, pop-ups or other interstitials (Rule 7.05(B)). Loyalty schemes are not a back door either: the Attorney General’s FAQ says using loyalty-program data for targeted advertising is a secondary use that needs consent.

What the privacy notice must say

The Act lists five things a notice includes (§ 6-1-1308(1)(a)) and asks for a clear disclosure of any sale or targeted advertising and how to opt out of it (§ 6-1-1308(1)(b)). Rule 6.03 turns that into eight items, with a level of detail the statute does not spell out. Categories must be specific enough to mean something: the rule’s own examples include “Information from Cookies” and “payment information” for data, and “analytics companies” or “data brokers” for recipients.

Item 4 carries the line a notice written for another state may lack: since 1 July 2024 it must explain how universal opt-out requests are processed. The opt-out method must also sit outside the notice, in a clear, conspicuous and readily accessible place (§ 6-1-1306(1)(a)(III)).

Data protection assessments under the rules

The Act requires a documented assessment before any processing that presents a heightened risk of harm, and names four kinds (§ 6-1-1309(2)):

• Targeted advertising
• Profiling with a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial or physical injury, an offensive intrusion on privacy, or other substantial injury
• Selling personal data
• Processing sensitive data

The statute asks you to weigh benefits against risks as reduced by safeguards (§ 6-1-1309(3)). Rule 8.04 then sets a minimum of thirteen items, which goes well past that one-sentence test:

When, how often, how long

• Write it before the processing starts (Rule 8.05(A)); it is required for activities created or generated after 1 July 2023, not retroactively.
• Review it as often as the risk warrants; an assessment covering profiling for significant decisions is reviewed at least once a year, with a fresh fairness and disparate-impact check (Rule 8.05(B)–(C)).
• A material change (new purpose, new data source, new processor, a changed algorithm) makes it a new activity that needs an updated assessment (Rule 8.05(D)).
• Keep every version for as long as the processing continues and at least three years after it ends, in an electronic, transferable form (Rule 8.05(E)).
• One assessment can cover a comparable set of operations with similar activities (§ 6-1-1309(5)).

Enforcement, and what changed since 2023

Enforcement belongs to the Attorney General and district attorneys, who share exclusive authority (§ 6-1-1311(1)(a)). There is no private right of action (§ 6-1-1310(1)). For their enforcement, a violation is a deceptive trade practice under the Colorado Consumer Protection Act (§ 6-1-1311(1)(c)), which is where the penalties come from. The penalty answer in the Attorney General’s FAQ was blank when read, so this page does not state an amount. The Act also preempts local privacy ordinances (§ 6-1-1312).

The cure period is gone: 60 days, ended 1 Jan 2025. Before then, a regulator had to send a notice of violation and wait 60 days where a cure was possible. Since then, a regulator can sue without that step.

The 2025 amendments were still proposed on the Department’s rulemaking page when read; watch it for the adopted text. For how Colorado sits among the other state laws, see the US state privacy laws table.

Questions