Colorado Privacy Act

The Colorado Privacy Act applies to businesses, including nonprofits, that do business in Colorado and, in a calendar year, handle the personal data of 100,000 or more Colorado consumers, or 25,000 or more while earning revenue or a discount from selling personal data. People acting in a job or business role aren’t “consumers” under the law.

Since July 1, 2024, businesses must accept opt-outs sent through a universal opt-out mechanism. Colorado’s Department of Law keeps the list of recognized mechanisms, and Global Privacy Control is the only one on it. The rules say you can’t require a login before honoring it.

In September 2025, Colorado joined California and Connecticut in a joint sweep, sending letters to businesses that did not appear to be processing GPC opt-outs.

• Coloradans can opt out of sale, targeted advertising and certain profiling, and can access, correct, delete and get a portable copy of their data.
• Respond within 45 days, extendable by another 45 days if you tell the person why within the first 45.
• Appeals: answer within 45 days (extendable by 60), and tell the person they can contact the Attorney General.

Under the rules, the notice describes the categories of data, why you use it, whether you sell it or use it for targeted ads, and who you share it with; lists people’s rights and how to use them, including how you handle universal opt-out requests and appeals; and shows the date it was last updated. It must be linked conspicuously from your homepage using the word “privacy”, written in plain language, and accessible to people with disabilities (the rules point to WCAG 2.1 for online notices). One general notice is enough if it covers everything.

Two amendments took effect in 2025. From July 1, 2025, anyone who handles biometric identifiers needs a written policy with a retention schedule and must meet disclosure and consent requirements before collecting them. From October 1, 2025, businesses that know, or willfully disregard, that a user is under 18 must take reasonable care to avoid heightened risks of harm, and need consent (a parent’s, under 13) before using a minor’s data for targeted ads or sale, using features designed to extend use, or collecting precise geolocation.

The Attorney General and district attorneys enforce the law; people can’t sue under it. A violation is a deceptive trade practice under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation. The 60-day period to cure a violation after notice ended on January 1, 2025.