Colorado. Comprehensive data protection. Act

CPAColorado Privacy Act (C.R.S. § 6-1-1301 et seq.)

In force

Partly verified

Medium confidence. Penalty figure from established knowledge.

§1Summary

Synopsis

Provides consumer rights and opt-outs similar to Virginia but backed by detailed AG rules, including recognised universal opt-out mechanisms. Amendments add heightened duties for minors' data and biometric identifiers.

Key themes

consumer rights (access, deletion, correction, portability)
opt-out of sale, targeted advertising and profiling
sensitive data consent
data protection assessments
processor contracts
universal opt-out mechanism
minors' data
biometrics

Unique features

Applies to non-profits; detailed implementing regulations; mandatory recognition of approved opt-out signals.

SaaS relevance

Applies to controllers handling data of 100,000+ Colorado consumers, or 25,000+ deriving revenue or discounts from sales; biometric and minors' provisions apply regardless of thresholds.

§2Obligations

Extraterritorial: Yes
Breach notification: See C.R.S. § 6-1-716 (separate statute)
DPO: No
Cross-border transfers: None
Maximum penalty: Up to $20,000 per violation (Colorado Consumer Protection Act)

§3Dates

Key dates

Adopted 7 July 2021
In force 1 July 2023
Universal opt-out mechanism required from 2024-07-01; cure period ended 2025-01-01; biometric amendment (HB 24-1130) effective 2025-07-01; minors' amendment (SB 24-041) effective 2025-10-01; AG rules amended 2025.

§4Text and authority

Text

Authoritative text leg.colorado.gov

Authority

Colorado Attorney General and District Attorneys

§5Where it applies

Domestic law of: Colorado

§6Sources and verification

Verification

Medium confidence.

Partly verified

Medium confidence. Penalty figure from established knowledge.