Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA) is a comprehensive state privacy law regulating the collection, processing, and use of personal data by organisations that conduct business in Colorado or target Colorado residents. The Act grants consumers rights over their personal information, including access, correction, deletion, portability, and the ability to opt out of targeted advertising, data sales, and certain profiling activities. The CPA establishes obligations for controllers and processors relating to transparency, consent, data security, privacy notices, and responsible data governance.