Colorado Privacy Act Rules

CPA Rules
active

The Attorney General's rules implementing the Colorado Privacy Act. They set detailed requirements for privacy notices, rights requests, universal opt-out mechanisms, valid consent and dark patterns, data protection assessments, profiling, and opinion letters. Amendments effective January 30, 2025 added biometric and opinion-letter rules, and amendments effective December 1, 2025 implemented the minors' (SB 24-041) and precise geolocation (SB 25-276) changes.

Jurisdiction

Colorado

Jurisdiction Type

state

Country

United States

Effective Date

7/1/2023

Enforcing Authority

Colorado Attorney General (Department of Law, Consumer Protection Section)

Fines Under This Regulation

0

Total Fine Amount (USD)

--

View Official Text →