COLORADO · STATE RESEARCH PROFILEColorado Privacy Act
CPA · Normalized Research Card v2.1
IN FORCELAST VERIFIED · AUG 26 2026At a glance
Who must comply?
Applicability model: Numerical threshold.
Core threshold: 100,000 consumers; or 25,000 consumers plus revenue/discount from sale of personal data
Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.
Consumer rights
| Right / protection | Status |
|---|---|
| Access | ✓ Included / qualified by statute |
| Correction | ✓ Included / qualified by statute |
| Deletion | ✓ Included / qualified by statute |
| Portability | ✓ Included / qualified by statute |
| Opt-out of sale | ✓ Included / qualified by statute |
| Opt-out of targeted advertising | ✓ Included / qualified by statute |
| Opt-out of qualifying profiling | ✓ Included / qualified by statute |
Sensitive data & minors
Sensitive-data standard: Consent required for sensitive data
Colorado has added age-related protections and rules affecting minors; current regulations should be checked for operational details.
Business obligations
Privacy notices, data minimization, security, consent for sensitive data, processor governance and data protection assessments for heightened-risk processing.
Enforcement
Authority: Colorado Attorney General / district attorneys
Private right of action: No
Penalty / remedy baseline: Enforced through Colorado Consumer Protection Act
What makes Colorado different?
Colorado is a leading operational model because detailed rules govern consent, assessments and universal opt-out mechanisms. It is particularly useful as a compliance benchmark outside California.
Developments to watch
Colorado continues to use rulemaking to operationalize the CPA; universal opt-out requirements are already part of the live compliance framework.
Editorial rule: future-effective, proposed and pending measures are kept separate from current law.
Primary sources & verification
Last verified: August 26, 2026
Research standard: primary official sources prioritized; official guidance used to explain operational requirements.