Privacy Law Library

Colorado Privacy Act

CPA

Comprehensive privacy · Children · Biometric · Location · Data security

Colorado's comprehensive consumer privacy law gives residents rights to opt out of targeted advertising, sale, and significant-decision profiling, and to access, correct, delete, and port their personal data, with an appeal process. Controllers must give a privacy notice, minimize and secure data, get opt-in consent for sensitive data, honor universal opt-out signals, and run data protection assessments. Amendments added biological and neural data (2024), biometric rules (2025), minors' online protections (2025), and precise geolocation as sensitive data with consent required to sell sensitive data (2025).

Where

Colorado

Citation

C.R.S. 6-1-1301 to 6-1-1314 (Title 6, Article 1, Part 13)

Status

In force

In force since

2023-07-01

Last amended

2025-10-01

Enforced by

Colorado Attorney General and district attorneys (exclusive; 6-1-1311(1)(a))

People can sue

No

Penalties

A violation is a deceptive trade practice under the Colorado Consumer Protection Act, so civil penalties of up to $20,000 per violation (each consumer or transaction a separate violation; up to $50,000 where the victim is elderly) plus injunctions (6-1-1311(1)(c); 6-1-112(1)). The general 60-day cure period expired January 1, 2025; a 60-day cure period for the minors' provisions runs until December 31, 2026 (6-1-1311(1)(d)).

Applies to

• Controllers that conduct business in Colorado or produce or deliver commercial products or services intentionally targeted to Colorado residents and that control or process personal data of 100,000+ consumers in a calendar year, or derive revenue or a discount from the sale of personal data and process personal data of 25,000+ consumers (6-1-1304(1)(a)(I))
• Since 2025-07-01: any controller that processes any amount of biometric identifiers or biometric data, for those data only, regardless of volume (6-1-1304(1)(a)(II), added by HB 24-1130)
• Since 2025-10-01: the minors' provisions (6-1-1305.5, 6-1-1308.5, 6-1-1309.5) apply to any controller doing business in or targeting Colorado, with no volume threshold (6-1-1304(1)(b), added by SB 24-041)
• Nonprofits are not exempt. Exempt: HIPAA PHI and covered-entity data, FCRA-regulated activity, GLBA-regulated data and GLBA financial institutions and affiliates (entity-level), COPPA- and FERPA-regulated data, DPPA data, employment records, air carriers, national securities associations, certain public-utility customer data, and noncommercial government and public higher-education data (6-1-1304(2))
• 'Consumer' means a Colorado resident acting in an individual or household context; employees and job applicants are excluded except for the biometric rules in 6-1-1314 (6-1-1303(6))