Colorado Privacy Act (CPA)

Why does it matter?

The CPA covers nonprofits as well as businesses and is triggered by the number of Colorado consumers, not by company revenue, so many mid-size organizations are covered. Violations are deceptive trade practices enforced by the Attorney General, and the general 60-day right to cure ended on January 1, 2025 (§ 6-1-1311).

Key benefits include:

• A defined coverage test

A controller that does business in Colorado or targets Colorado residents is covered at 100,000 consumers, or at 25,000 consumers when it also earns revenue or a discount from selling personal data (§ 6-1-1304(1)). Employees and job applicants are not consumers (§ 6-1-1303(6)).

• Consumer rights with deadlines

Consumers can opt out of targeted advertising, sale and certain profiling, and can access, correct, delete and port their data. Controllers answer within 45 days, with one 45-day extension, and must run an appeal process (§ 6-1-1306).

• Universal opt-out signals

Since July 1, 2024, a controller that processes data for targeted advertising or sale must honor a universal opt-out mechanism that meets the Attorney General's specifications (§ 6-1-1306(1)(a)(IV)(B)).

• A stated consent standard

Consent must be an affirmative, freely given, specific, informed and unambiguous act. The Attorney General says acceptance of broad terms, hovering over content or deceptive page design is not consent.

• One enforcer

Only the Attorney General and district attorneys can enforce the CPA, and the CPA creates no private right of action (§§ 6-1-1310 and 6-1-1311).

How does it work?

Part 13 contains definitions (§ 6-1-1303), applicability and exemptions (§ 6-1-1304), processor duties (§ 6-1-1305), consumer rights (§ 6-1-1306), de-identified data (§ 6-1-1307), controller duties (§ 6-1-1308), data protection assessments (§ 6-1-1309), liability (§ 6-1-1310), enforcement (§ 6-1-1311), preemption of local laws (§ 6-1-1312) and the Attorney General's rulemaking and opt-out mechanism (§ 6-1-1313).

Controllers implement it by mapping personal data and purposes, publishing a privacy notice that lists data categories, purposes, third-party sharing and how to exercise rights and appeal (§ 6-1-1308(1)), setting up request and appeal workflows, obtaining consent before processing sensitive data (§ 6-1-1308(7)), and signing a binding contract with each processor that defines the responsibilities of both parties.

In SmartSuite, teams can use Privacy Management for the processing inventory and the consumer request log, keep data protection assessments and sensitive data consent records alongside them, and track processor agreements in Third Party Risk Management.

Key Elements

• Applicability and exemptions (§ 6-1-1304)

The thresholds are 100,000 Colorado consumers in a calendar year, or 25,000 with revenue or a discount from selling personal data. Section 6-1-1304(2) exempts specified data, such as HIPAA protected health information and activity regulated by the Fair Credit Reporting Act, and the Attorney General's FAQ also lists GLBA financial institutions, air carriers and national securities associations.

• Consumer rights (§ 6-1-1306)

Rights to opt out of targeted advertising, sale and profiling that produces legal or similarly significant effects; to confirm and access data; to correct; to delete; and to portability, up to twice a year. A refusal can be appealed, and the controller must answer the appeal within 45 days, extendable by 60.

• Controller duties (§ 6-1-1308)

Transparency through a privacy notice, purpose specification, data minimization, avoiding secondary use without consent, a duty of care for security, avoiding unlawful discrimination, and consent before processing sensitive data.

• Data protection assessments (§ 6-1-1309)

Required for heightened-risk processing: targeted advertising, profiling with a reasonably foreseeable risk of unfair treatment, injury or intrusion, selling personal data, and processing sensitive data. They weigh benefits against risks, are confidential, go to the Attorney General on request, and apply to processing created after July 1, 2023.

• Sensitive data

Data revealing race or ethnic origin, religious beliefs, mental or physical health conditions or diagnoses, sexual activity, preferences or orientation, or citizenship; biometric data used for identification; and data of a known child under 13. HB24-1058 added biological and neural data, and SB25-276 added precise geolocation data within a radius of 1,850 feet.

• Biometrics and minors (HB24-1130 and SB24-041)

From July 1, 2025, controllers of biometric identifiers need a written retention and incident policy, disclosures and consent before collection. From October 1, 2025, a controller offering an online service to a known or willfully disregarded minor must use reasonable care against heightened risk of harm, run assessments and get consent for targeted advertising, sale and profiling.

• Rules and enforcement (§§ 6-1-1311 and 6-1-1313)

The CPA Rules, 4 CCR 904-3, were filed March 15, 2023 and took effect July 1, 2023. Amendments adopted December 5, 2024 took effect January 30, 2025, and further amendments for SB24-041 and SB25-276 were adopted October 8, 2025. The general cure period ended January 1, 2025, while a 60-day cure for the minors provisions runs to December 31, 2026.

What does it cover?

The CPA protects Colorado residents acting in an individual or household context. It does not cover individuals acting as employees, job applicants or in a commercial context (§ 6-1-1303(6)). It applies to controllers wherever they are located if they meet the § 6-1-1304 tests, and processors are bound through the controller-processor contract. The minors provisions added by SB24-041 apply to any controller that does business in Colorado or targets Colorado residents, whatever its data volume or revenue.

What are its objectives?

The CPA aims to give Colorado consumers control over their personal data and to hold controllers to defined duties.

Let consumers opt out of targeted advertising, sale and consequential profiling, including through a universal opt-out mechanism.

Give consumers access, correction, deletion and portability rights with 45-day response times.

Require transparency, purpose specification, data minimization and care in processing (§ 6-1-1308).

Require consent before processing sensitive data and before secondary use.

Require documented data protection assessments for heightened-risk processing (§ 6-1-1309).

Add specific rules for biometric identifiers, minors' online data, neural and biological data and precise geolocation data.

Framework in Context

The CPA is part of Colorado's Consumer Protection Act and preempts local laws on the processing of personal data (§ 6-1-1312). Other state laws, such as the Connecticut Data Privacy Act, set their own thresholds and exemptions; Connecticut has applied at 35,000 consumers since July 1, 2026, so organizations map each state separately.

Common Framework Mappings

Organizations map the CPA to other state, national and international privacy laws to reuse controls, consent records and assessments.

Mapped frameworks include:

LGPD

CCPA/CPRA

GDPR

ISO 27001:2022

ISO 27701

NIST Privacy Framework v1.0

PIPEDA

UK GDPR