Skip to Primary Navigation

Colorado Privacy Act (CPA)

Colorado's comprehensive data privacy law establishing consumer privacy rights and business data protection duties.

Rule Overview

Jurisdiction: Colorado

Regulator: Colorado Attorney General's Office

Topic: Data Protection

Colo. Rev. Stat. Section 6-1-1301 et seq.
Overview
Latest News

The CPA applies to entities conducting business in Colorado or intentionally targeting Colorado residents that annually process personal data of 100,000+ consumers, or 25,000+ consumers while deriving revenue from data sales.

  • Consumer Rights & Opt-Outs: Grants residents rights to access, correct, delete, and port personal data. Mandates opt-outs for targeted ads, data sales, and profiling, including honoring Universal Opt-Out Mechanisms.
  • Sensitive Data & Risk Reviews: Requires explicit opt-in consent for sensitive data and mandatory Data Protection Assessments before high-risk processing.
  • Governance: Mandates clear privacy notices, vendor Data Processing Agreements (DPAs), and security controls.
View More News