← Global Privacy Laws Research Library
C.R.S. §6-1-1301 et seq.
Colorado Privacy Act
Colorado Privacy Act: CPA
Prepared by Shubhank Suman · Last reviewed
CURRENT
- Legal character
- State statute + regulations
- Region
- North America
- Effective
- 1 July 2023
What it covers
The CPA creates a comprehensive consumer privacy framework covering:
- access
- correction
- deletion
- portability
- sale opt-out
- targeted-advertising opt-out
- profiling opt-out
- sensitive data
- controller/processor duties
- data-protection assessments
- universal opt-out mechanisms.
The Colorado Attorney General confirms that the statute became effective on 1 July 2023. (Colorado Attorney General)
Why it matters
Colorado's law is particularly notable for three features:
1. universal opt-out mechanisms;
2. risk-based data-protection assessments;
3. profiling rights.
The Colorado Attorney General currently recognises Global Privacy Control as the valid universal opt-out mechanism for enforcement purposes. (Colorado Attorney General)
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: High
AI
HIGH
The law's main AI intersection is profiling in furtherance of decisions producing legal or similarly significant effects.
It is therefore useful when analysing AI-driven:
- consumer scoring
- advertising
- profiling
- personalisation
- significant consumer decisions.
Cybersecurity
HIGH
Reasonable security safeguards and risk assessments are important components.
Applicability
The CPA generally applies to controllers doing business in Colorado or targeting Colorado residents and satisfying statutory processing thresholds/exclusions.
The statute defines a consumer as a Colorado resident acting in an individual or household context. Employment data is generally outside this consumer definition. (Colorado Attorney General)
Current validity
CURRENT: supplemented by CPA Rules.
Read first
§6-1-1303 → §6-1-1304 → §6-1-1306 → §6-1-1308 → profiling → §6-1-1311 → §6-1-1313.
Provisions / sections covered
§6-1-1303
Definitions.
§6-1-1304
Scope and exemptions.
§6-1-1305
Processor duties.
§6-1-1306
Consumer rights and opt-out mechanisms.
§6-1-1308
Controller duties.
These include:
- transparency
- minimisation
- purpose specification
- security
- non-discrimination.
§6-1-1311
Data protection assessments.
Covered controllers must conduct assessments where processing presents heightened risk, including:
- targeted advertising
- sale
- sensitive data
- profiling.
The Colorado legislature's official bill summary confirms these assessment requirements. (leg.colorado.gov)
§6-1-1313
Universal opt-out mechanism.
Colorado requires covered businesses to accept qualifying universal opt-out signals; the AG's current guidance identifies GPC as the recognised mechanism. (Colorado Attorney General)
Subject-matter tags
- Consent
- Sensitive data
- Erasure and deletion
- Data portability
- Profiling
- Security
- Cross-border transfers
- Data protection officer
- Controller and processor
- Employment data
- Enforcement and penalties
- Transparency
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.