DPO SchoolDPO School

Colorado Privacy Act

Colorado privacy law (CPA): applicability

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Act covers controllers that do business in Colorado or intentionally target Colorado residents and either control or process personal data of 100,000 or more consumers in a calendar year, or earn revenue or receive a discount from selling personal data and handle data of 25,000 or more consumers. Since 1 July 2025 any controller that processes biometric data is covered for that data, and since 1 October 2025 the minors' duties apply to any controller doing business in Colorado regardless of volume. There is no nonprofit exemption. GLBA financial institutions and their affiliates are exempt as entities, and many data types (HIPAA, FCRA, FERPA, employment records) are exempt.

Key points

  1. Threshold one: personal data of 100,000 or more consumers in a calendar year.

    Section: C.R.S. § 6-1-1304(1)(a)(I)(B)

  2. Threshold two: any revenue or discount from selling personal data plus data of 25,000 or more consumers.

    Section: C.R.S. § 6-1-1304(1)(a)(I)(B)

  3. Any controller processing biometric identifiers or biometric data is covered for that data (from 1 July 2025).

    Section: C.R.S. § 6-1-1304(1)(a)(II)

  4. Minors' duties and enforcement provisions apply to any controller doing business in or targeting Colorado (from 1 October 2025).

    Section: C.R.S. § 6-1-1304(1)(b)

  5. Financial institutions and affiliates subject to GLBA are exempt; GLBA-compliant data is also exempt.

    Section: C.R.S. § 6-1-1304(2)(q), (2)(j)(II)

  6. No nonprofit exemption; only data of state higher education institutions and government used for noncommercial purposes is exempt.

    Section: C.R.S. § 6-1-1304(2)(o)

  7. Employment records data is exempt and 'consumer' excludes people acting in a commercial or employment context or as job applicants.

    Section: C.R.S. §§ 6-1-1303(6), 6-1-1304(2)(k)

Sources

Compare applicability across all states

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Colorado statute

Reference material, not legal advice.