Colorado Privacy Act (CPA) Reference Guide

The CPA generally applies to a controller that conducts business in Colorado or produces or delivers commercial products or services intentionally targeted to Colorado residents and meets at least one threshold: controlling or processing personal data of at least 100,000 Colorado consumers during a calendar year; or deriving revenue or receiving a discount on goods or services from selling personal data while controlling or processing personal data of at least 25,000 Colorado consumers. The CPA has no general annual-revenue threshold. Colorado General Assembly: SB21-190 Colorado Attorney General: CPA FAQ

A consumer is a Colorado resident acting in an individual or household context. The definition generally excludes someone acting in a commercial or employment context, as a job applicant, or as the beneficiary of a person acting in an employment context. The 100,000-consumer threshold therefore refers to Colorado consumers, not individuals nationwide. Colorado Attorney General: CPA FAQ

Unlike several state privacy laws, the CPA can apply to nonprofit organizations when they meet the statutory conditions. Controllers and processors have different duties, and the same organization can be a controller for one processing activity and a processor for another.

The CPA excludes specified entities and data, including certain state and local government bodies, financial institutions and affiliates subject to the Gramm-Leach-Bliley Act, air carriers, national securities associations, and data governed by listed federal or state laws. A data-level exemption does not necessarily remove every activity of the organization from the CPA. C.R.S. § 6-1-1304 summary

Colorado’s newer minor-data provisions have broader reach for covered online services, products, or features. Effective October 1, 2025, specified duties can apply to a controller doing business in Colorado or targeting Colorado residents regardless of the ordinary volume and revenue thresholds when the controller knows or willfully disregards that a consumer is a minor and the service presents a heightened risk of harm. Colorado General Assembly: SB24-041

Colorado also added specific biometric-identifier protections effective July 1, 2025. Organizations using facial geometry, voiceprints, fingerprints, or similar identifiers should assess those provisions separately rather than assuming that the ordinary CPA thresholds resolve the issue. Colorado General Assembly: HB24-1130

CPA compliance requires operational processes, not only a privacy policy. Covered controllers need working request methods, purpose and minimization controls, sensitive-data consent, processor contracts, security practices, data protection assessments, and technical systems that carry a consumer’s opt-out into the advertising and data stack.

The CPA covers information that is linked or reasonably linkable to an identified or identifiable individual. On a website, that can include identifiers, device and browser data, page activity, advertising interactions, location-related information, and data combined across services when it can be linked to a Colorado consumer. Publicly available information and deidentified data are treated separately under the statute.

Colorado defines a sale as exchanging personal data for monetary or other valuable consideration, subject to statutory exceptions. Targeted advertising generally means displaying an advertisement selected from personal data obtained or inferred from the consumer’s activities over time and across nonaffiliated websites, applications, or online services. Contextual advertising and certain first-party activities are excluded. Colorado Privacy Act definitions

Advertising pixels, remarketing tags, attribution services, session replay, analytics, embedded media, chat, and hard-coded scripts can disclose identifiers and page activity before a visitor submits a form. A network request is not automatically a sale or targeted advertising; legal classification depends on the data, recipient, purpose, consideration, contract, and applicable exception.

The CPA does not categorically prohibit Google, Meta, analytics, or other third-party tools. It requires covered controllers to classify and disclose processing accurately, use appropriate contracts, minimize collection, and make required opt-outs work in practice.

A consumer can click an opt-out while a hard-coded advertising pixel keeps sending data. A consent platform can record a rejection while a tag-manager rule ignores it. GPC can reach the top-level browser request but never reach a script loaded through an embedded frame. Those are implementation failures that a policy review alone cannot expose.

Colorado’s Attorney General has specifically emphasized sensitive-data consent, targeted-advertising opt-outs, and universal opt-out mechanisms in enforcement guidance. In September 2025, Colorado joined California and Connecticut in a coordinated sweep of businesses that may not have processed GPC requests. Colorado Attorney General: enforcement launch Joint GPC sweep

Beginning July 1, 2024, a controller subject to the CPA must allow consumers to opt out of personal-data sales and targeted advertising through a recognized universal opt-out mechanism. Colorado’s Department of Law currently lists Global Privacy Control as the only recognized mechanism prioritized for enforcement. Colorado Attorney General: Universal Opt-Out and the CPA

The signal must communicate an affirmative, freely given, and unambiguous choice. A controller cannot require a consumer to create an account or provide additional information before honoring a valid browser- or device-level signal. When the controller can authenticate the consumer and the consumer chooses to associate the signal with an account, the choice can be applied beyond that browser or device under the CPA Rules.

The privacy notice must explain how universal opt-out requests are processed. The technical implementation must then make the website’s sale and targeted-advertising behavior match that explanation. 4 CCR 904-3, Rules 5 and 6

The Colorado Attorney General and district attorneys have exclusive enforcement authority under the CPA. The statute does not create a private right of action. A CPA violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act. Colorado General Assembly: SB21-190

Civil penalties can reach $20,000 per violation, and each affected consumer or transaction can constitute a separate violation under C.R.S. § 6-1-112. The CPA’s temporary requirement to provide 60 days to cure a remediable violation expired January 1, 2025, so organizations should not plan around a guaranteed pre-enforcement cure opportunity. Colorado Attorney General: civil-penalty amendment Colorado Attorney General: CPA FAQ

The legal and technical layers should inform each other, but they are not the same job. A website scan cannot decide statutory applicability. A privacy policy cannot prove that a consumer’s opt-out or GPC signal actually reaches the tracking stack.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This page is written from primary Colorado sources. Material legal statements link to the Colorado General Assembly, Colorado Attorney General, or the governing CPA Rules. Secondary sources are not treated as authority for the law.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records the technical tracking layer: privacy state, browser privacy signals, cookies, scripts, tags, network requests, and observable post-choice behavior. Your legal and privacy team remains responsible for legal interpretation, applicability and exemptions, notices and disclosures, contracts, consumer-rights operations, sensitive-data consent, minor-data and biometric obligations, assessments, security, retention, and organization-wide compliance.