Colorado Privacy Act (CPA)
Amended Colorado · In force Jul 1, 2023 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.
- Who it applies to
- Controllers doing business in Colorado or targeting Colorado residents that control or process personal data of 100,000+ consumers per year, or derive revenue or discounts from selling personal data and process personal data of 25,000+ consumers. Biometric provisions (HB 24-1130) and minors' provisions (SB 24-041) apply regardless of these volume thresholds.
- Penalties
- Violations are deceptive trade practices under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation (up to $50,000 per violation against an elderly person), per C.R.S. 6-1-112. 60-day cure period applied only until Jan 1, 2025.
- Enforced by
- Colorado Attorney General and district attorneys
- Official name
- Colorado Privacy Act (SB 21-190), C.R.S. 6-1-1301 et seq., as amended by HB 24-1130, SB 24-041 and SB 25-276
- Citation
- SB 21-190 (2021 Colo. Sess. Laws ch. 483); C.R.S. 6-1-1301 to 6-1-1313; 4 CCR 904-3 (CPA Rules)
- Topics
- privacy, children, biometrics
Research notes
CO AG site (coag.gov) could not be fetched directly during verification; dates taken from leg.colorado.gov bill pages. The separate Colorado AI Act (SB 24-205, rewritten 2026) is a distinct law not covered here. No 2026 CPA amendments were confirmed; web search budget ran out before a full 2026 session check.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Colorado Privacy Act (CPA)
- What are the Colorado Privacy Act (CPA) compliance deadlines?
- Jul 1, 2023: CPA takes effect. Jul 1, 2024: Universal opt-out mechanism recognition required. Jan 1, 2025: 60-day cure period expires. May 23, 2025: SB 25-276 geolocation and sensitive-data sale amendment effective. Jul 1, 2025: Biometric identifier amendment (HB 24-1130) effective. Oct 1, 2025: Minors' data amendment (SB 24-041) effective.
- When does Colorado Privacy Act (CPA) take effect?
- Colorado Privacy Act (CPA) took effect on Jul 1, 2023.
- Who does Colorado Privacy Act (CPA) apply to?
- Controllers doing business in Colorado or targeting Colorado residents that control or process personal data of 100,000+ consumers per year, or derive revenue or discounts from selling personal data and process personal data of 25,000+ consumers. Biometric provisions (HB 24-1130) and minors' provisions (SB 24-041) apply regardless of these volume thresholds.
- What are the penalties under Colorado Privacy Act (CPA)?
- Violations are deceptive trade practices under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation (up to $50,000 per violation against an elderly person), per C.R.S. 6-1-112. 60-day cure period applied only until Jan 1, 2025.