Skip to content
Rulebook.
Jurisdiction ยท 2 regulations

Colorado privacy and AI laws

2 regulations in Colorado that affect companies handling data: Colorado AI Act, Colorado Privacy Act (CPA). Part of US States.

2 regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Upcoming deadlines

January 20272 deadlines

  1. Colorado AI Act

    ADMT obligations apply

    Developer documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.

    Takes effectin 3 monthsSource
  2. Colorado AI Act

    AG rules due

    Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.

    Compliance deadlinein 3 monthsSource

January 20301 deadline

  1. Colorado AI Act

    Mandatory cure period ends

    The AG's obligation to offer a 60-day notice-and-cure period expires.

    Sunsetin 3.3 yearsSource

Past deadlines

June 20261 deadline

  1. Colorado AI Act

    Delayed effective date (superseded)

    SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.

    Transition3 months agoSource

May 20261 deadline

  1. Colorado AI Act

    SB 26-189 signed (repeal and reenact)

    SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.

    Transition4 months agoSource

February 20261 deadline

  1. Colorado AI Act

    Original effective date (superseded)

    Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.

    Transition8 months agoSource

October 20251 deadline

  1. Colorado Privacy Act (CPA)

    Minors' data amendment (SB 24-041) effective

    Controllers offering online services to minors must use reasonable care, conduct assessments, and obtain consent for targeted ads, sale and certain profiling of minors.

    Takes effect12 months agoSource

August 20251 deadline

  1. Colorado AI Act

    SB 25B-004 delays the act

    Special-session bill pushes the SB 24-205 effective date from February 1, 2026 to June 30, 2026.

    Transition13 months agoSource

July 20251 deadline

  1. Colorado Privacy Act (CPA)

    Biometric identifier amendment (HB 24-1130) effective

    Any controller processing biometric identifiers must adopt a written biometric policy, give notice, obtain consent and follow retention/deletion rules.

    Takes effect15 months agoSource

May 20251 deadline

  1. Colorado Privacy Act (CPA)

    SB 25-276 geolocation and sensitive-data sale amendment effective

    Adds precise geolocation data definitions and prohibits selling sensitive data without consent (effective on signature).

    Takes effect16 months agoSource

January 20251 deadline

  1. Colorado Privacy Act (CPA)

    60-day cure period expires

    Mandatory 60-day notice-and-cure before AG enforcement ends; enforcement may proceed without cure.

    Enforcement21 months agoSource

July 20241 deadline

  1. Colorado Privacy Act (CPA)

    Universal opt-out mechanism recognition required

    Controllers must honor AG-recognized universal opt-out mechanisms (e.g. Global Privacy Control).

    Compliance deadline2.2 years agoSource

May 20241 deadline

  1. Colorado AI Act

    SB 24-205 signed

    Governor Polis signs the original Colorado AI Act with a February 1, 2026 effective date.

    Takes effect2.4 years agoSource

July 20231 deadline

  1. Colorado Privacy Act (CPA)

    CPA takes effect

    Core consumer rights and controller duties apply.

    Takes effect3.2 years agoSource

When the rules change: new data, privacy and AI laws and deadlines, the next morning.