Colorado Data Privacy Law (CPA): What Colorado Residents Need to Know

The Colorado Privacy Act (CPA) took effect on July 1, 2023, giving Colorado residents rights over their personal data. One feature separates it from most other state laws: businesses must honor technical opt-out signals like the Global Privacy Control, which went into effect in 2024. Here is what you need to know.

What Is the Colorado Privacy Act?

Governor Jared Polis signed the Colorado Privacy Act on July 8, 2021. It became effective July 1, 2023 — the same day as Connecticut's CTDPA. Colorado was the third state to pass a comprehensive consumer data privacy law, after California and Virginia.

The CPA applies to businesses that conduct business in Colorado or produce products or services intentionally targeted to Colorado residents, and that either: control or process personal data of at least 100,000 Colorado consumers per calendar year, or control or process personal data of at least 25,000 Colorado consumers and derive revenue or receive a discount on the price of goods or services from the sale of personal data. Like Virginia's VCDPA, there is no standalone revenue threshold.

The law defines "sale" broadly — the exchange of personal data for monetary or other valuable consideration — so data brokers who trade consumer profiles for advertising credits or data-sharing arrangements are still covered. Laws that restrict "sale" to direct cash transactions miss this. Colorado's definition doesn't.

Your Rights Under the Colorado CPA

Colorado residents have five enforceable rights under the CPA:

Businesses covered by the CPA must respond to consumer rights requests within 45 days, extendable by another 45 days with prior notice. Requests are free of charge up to twice per year; businesses may charge a reasonable fee for subsequent requests. They cannot retaliate against consumers for exercising their rights.

Colorado's Universal Opt-Out Requirement

The CPA's universal opt-out mechanism requirement is what sets it apart from most other state laws. Starting July 1, 2024, businesses must recognize and honor technical opt-out signals sent by consumers' browsers or devices.

The primary such signal is the Global Privacy Control (GPC) — a browser-level setting that sends an automated "do not sell or share my data" signal to every website you visit. When a covered business receives a GPC signal, it must treat it as a valid opt-out request for targeted advertising and data sale — without requiring the consumer to navigate to a separate opt-out page or complete a form.

In practice, this means you can set your preference once and have it automatically applied across all covered businesses, instead of opting out company-by-company. Colorado's GPC compliance requirement matches California's, making it one of the stronger browser-level opt-out provisions of any state law.

How the CPA Compares to CCPA

Colorado's maximum penalty of $20,000 per violation is higher than most comparable state laws, which cap violations at $7,500. The Colorado AG can bring enforcement actions and seek both civil penalties and injunctive relief.

What Data Brokers Must Do Under the CPA

Colorado's CPA imposes several obligations on data controllers, including data brokers:

• Publish a transparent privacy notice describing the categories of personal data processed, the purposes of processing, the consumer rights available, how to exercise those rights, and the categories of data shared with third parties.
• Honor opt-out requests for targeted advertising, data sales, and significant profiling — including universal opt-out signals (GPC) from browsers and devices as of July 1, 2024.
• Obtain meaningful consent before processing sensitive data categories, including precise geolocation, racial or ethnic origin, mental or physical health conditions, biometric data, personal data of children, immigration status, and financial information.
• Conduct data protection assessments for processing activities that present heightened risk, including targeted advertising, sale of personal data, and certain profiling activities.
• Process deletion requests within 45 days of receiving a verified consumer request, including directing processors to delete the data as well.
• Provide an appeals process if a consumer rights request is denied, with a response due within 45 days of the appeal submission.

Step-by-Step: How to Use the CPA to Delete Your Data

1. 1. Enable Global Privacy Control in your browser. Firefox and Brave have built-in GPC support. For Chrome, you can install the GPC browser extension. Once enabled, covered Colorado businesses must honor this as a valid opt-out signal for data sales and targeted advertising.
2. 2. Find the data broker's privacy notice. Navigate to the site's footer and look for a link labeled "Privacy Policy," "Your Privacy Rights," or "Do Not Sell My Personal Information." Colorado businesses are required to publish this notice prominently.
3. 3. Submit a deletion request. Use the company's designated opt-out or deletion request mechanism — typically a web form or email address. State that you are a Colorado resident and request deletion of all personal data the company holds about you.
4. 4. Verify your identity. The company may ask you to confirm your identity via email, a verification code, or a government ID check. Respond promptly to avoid delays in processing your request.
5. 5. Monitor the 45-day response window. Keep a record of when you submitted your request. If you do not receive a response within 45 days, or if the company notifies you of an extension, track the extended deadline.
6. 6. Appeal or escalate if necessary. If your request is denied, submit a formal appeal. If the appeal fails, file a complaint with the Colorado Attorney General at coag.gov. The AG has authority to seek civil penalties of up to $20,000 per violation.

The CPA's combination of universal opt-out requirements, high penalties, and mandatory data protection assessments puts Colorado among the more rigorous state privacy laws. For more on how these state laws affect data broker removal, see our guide to California's CCPA rights, or let GhostVault handle deletion requests automatically.

Frequently Asked Questions