Key Facts
Overview
The Colorado Privacy Act features the highest per-violation penalties among US state privacy laws ($20,000) and mandatory GPC signal honoring since July 2024. Colorado participated in a joint GPC enforcement sweep with California and Connecticut in September 2025, signaling aggressive enforcement.
What This Means for Your Website
- GPC (Global Privacy Control) signals must be honored since July 2024
- Opt-in consent is required for sensitive data processing
- The cure period was eliminated in January 2025, so the AG can take immediate action
- Penalties are $2,000-$20,000 per violation, the highest among US states
- October 2025 amendments add a duty of care for minors under 18 with no processing thresholds
Key Requirements
The Colorado AG and District Attorneys enforce the CPA. Consumer requests must be fulfilled within 45 days. The September 2025 joint GPC enforcement sweep with California and Connecticut demonstrates multi-state coordination on privacy enforcement. Biometric data processors are covered regardless of thresholds since July 2025.
How ConsentStack Handles This
ConsentStack detects Colorado visitors, honors GPC signals automatically, and applies the opt-out model with opt-in for sensitive data. The platform ensures compliance with the strictest US state penalty structure.
Penalties
$2,000-$20,000 per violation (treated as deceptive trade practices).
Key Requirements
- Honor GPC/universal opt-out signals since July 2024
- Opt-in consent for sensitive data processing
- Data protection assessments required
- Right to access, correct, delete, port, and opt out
- Data minimization obligations
Notable Provisions
- Highest per-violation penalty ($20,000) among US states
- Cure period eliminated January 2025
- Joint GPC sweep with CA and CT September 2025
- Biometric and minor protection expansions in 2025 remove thresholds
Data Subject Rights
Opt out of the processing of your personal data for targeted advertising, including through a universal opt-out mechanism that meets the Colorado Attorney General's technical specifications.
Opt out of the sale of your personal data, including through a universal opt-out mechanism that meets the Colorado Attorney General's technical specifications.
Opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, such as decisions about lending, housing, insurance, education, employment, health care or access to essential goods or services.
Authorize another person, including through a browser setting, browser extension or global device setting, to opt out on your behalf of targeted advertising, sale or profiling; this agent right covers opt-outs only.
Revoke consent you gave to targeted advertising or the sale of your personal data as easily as you gave it.
Confirm whether a controller is processing your personal data and access that data.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data concerning you.
When accessing your data, obtain it in a portable and, where technically feasible, readily usable format you can transmit to another entity, no more than twice per calendar year.
Appeal a controller's refusal to act on your request through an internal appeal process that must be conspicuously available and as easy to use as the request process.
If you have concerns about the result of an appeal, you may contact the Colorado Attorney General, and the controller must tell you so.
A controller may not increase the cost of, or decrease the availability of, a product or service based solely on your exercise of a right and unrelated to feasibility or the value of a service.
If a controller collects your biometric data, ask it to tell you, free of charge, what category of biometric data it holds, where it got the data, why it collects or processes it, and what biometric data it discloses to third parties.
If a controller collects your biometric data, ask it to tell you, free of charge, the identity of each third party it has disclosed or discloses that data to and its purposes for disclosing it.
US State Specifics
Other North America Regulations
Frequently Asked Questions
CPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with CPA
ConsentStack helps you implement Opt-out consent for Colorado, United States automatically.