Comprehensive state privacy law
Colorado privacy law
Colorado Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- C.R.S. §§ 6-1-1301 to 6-1-1314
- Enacted
- July 7, 2021. SB 21-190, Session Laws 2021, ch. 483
- In force
- July 1, 2023
- Effective dates
- July 1, 2023: main provisions; Attorney General rules (4 CCR 904-3) also effective
- July 1, 2024: controllers must honor universal opt-out mechanisms recognized by the Attorney General
- January 1, 2025: mandatory 60-day cure period repealed
- July 1, 2025: biometric identifier and biometric data duties (HB 24-1130), applying to any controller that processes any biometric data
- October 1, 2025: minors' protections (SB 24-041), applying to any controller doing business in Colorado regardless of volume
- December 31, 2026: 60-day cure period for the minors' provisions is repealed
- Enforcer
- Attorney General and district attorneys (exclusive)
- Private right of action
- No. The Act gives no private right of action for its violations or any other law (§§ 6-1-1310(1), 6-1-1311(1)(b)).
- Cure period
- 60 days. Ended January 1, 2025. The general 60-day notice and cure was repealed effective 1 January 2025. A separate 60-day cure for the minors' provisions (§§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5) applies from 1 October 2025 and is repealed effective 31 December 2026. (C.R.S. § 6-1-1311(1)(d))
- Rulemaking
- Yes, Colorado Attorney General (Department of Law). Colorado Privacy Act Rules, 4 CCR 904-3, filed 15 March 2023 and effective 1 July 2023. The Department filed proposed amendments on 29 July 2025 to implement SB 24-041 and SB 25-276; their final adoption and effective date were not confirmed on an official page. Rules
Amendments
- HB 24-1058, Session Laws 2024, ch. 68 (in force August 7, 2024). Added 'biological data' (including neural data) to sensitive data.
- HB 24-1130, Session Laws 2024, ch. 313 (in force July 1, 2025). New § 6-1-1314 on biometric identifiers: written retention and deletion policy, notice and consent duties, limits on sale, a right to access biometric data, and rules for employers; controllers processing any biometric data are covered for that data even below the volume thresholds.
- SB 24-041, Session Laws 2024, ch. 296 (in force October 1, 2025). Minors (under 18): duty of reasonable care to avoid heightened risk of harm; consent needed for targeted advertising, sale, significant-effect profiling, design features that extend use, and precise geolocation collection; data protection assessments for services offered to minors; applies to any controller doing business in Colorado; 60-day cure until 31 December 2026.
- SB 25-276, Session Laws 2025, ch. 240, §§ 18 to 20 (in force May 23, 2025). Added precise geolocation data (within 1,850 feet) to sensitive data, and requires consent before selling sensitive data. Signed 23 May 2025; effective on signature per the General Assembly bill page.
Topics
- ApplicabilityThe Act covers controllers that do business in Colorado or intentionally target Colorado residents and either control or process personal data of 100,000 or more consumers in a calendar year, or earn revenue or receive a discount from selling personal data and handle data of 25,000 or more consumers. Since 1 July 2025 any controller that processes biometric data is covered for that data, and since 1 October 2025 the minors' duties apply to any controller doing business in Colorado regardless of volume. There is no nonprofit exemption. GLBA financial institutions and their affiliates are exempt as entities, and many data types (HIPAA, FCRA, FERPA, employment records) are exempt.
- Consumer rightsConsumers may opt out of targeted advertising, sale and profiling for significant-effect decisions, and may access, correct, delete and obtain a portable copy of their data (portability up to twice a year). Controllers must act within 45 days, extendable by 45 days with notice and reasons. The first request in 12 months is free. Appeals must be decided within 45 days, extendable by 60 days, with a reference to the Attorney General.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, health conditions, sex life or sexual orientation, citizenship status, genetic or biometric data used to identify a person, data of a known child, biological data including neural data, and (since 23 May 2025) precise geolocation data. Controllers need prior consent to process or sell sensitive data, and a parent's consent for a known child under 13. Since 1 October 2025, controllers offering online services to known minors under 18 need consent before targeted advertising, sale, significant-effect profiling, engagement-extending design or precise geolocation collection.
- Controller dutiesControllers must give a clear privacy notice, specify purposes, keep collection adequate, relevant and limited to what is reasonably necessary, avoid secondary use without consent, keep data secure and avoid unlawful discrimination. They must document data protection assessments before heightened-risk processing, and separate assessments for services offered to minors. Since 1 July 2024 they must honor universal opt-out mechanisms recognized by the Attorney General, and the Attorney General's rules (4 CCR 904-3) add detailed requirements.
- ProcessorsProcessors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. They must keep staff bound by confidentiality and use subcontractors only after the controller can object, under a written contract. A binding contract must set out instructions, nature and purpose, data types, duration, deletion or return, compliance information and audits (or an annual independent audit at the processor's expense, with the controller's consent).
- EnforcementThe Attorney General and district attorneys enforce the Act; violations are deceptive trade practices under the Colorado Consumer Protection Act. The general 60-day cure period was repealed on 1 January 2025, but a 60-day cure still applies to the minors' provisions until 31 December 2026. Civil penalties are up to $20,000 per violation, counted per consumer or transaction, and up to $50,000 where the victim is elderly. There is no private right of action.
Sources
- Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)
- Colorado General Assembly, SB 25-276 bill page
- SB 25-276 signed act (PDF)
- Colorado Attorney General, Colorado Privacy Act page
- Colorado Attorney General, CPA rulemaking page
- Law-firm reports on the 2025 rule amendments (used only to find leads)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Colorado statute
Reference material, not legal advice.