DPO SchoolDPO School

Colorado Privacy Act

Colorado privacy law (CPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may opt out of targeted advertising, sale and profiling for significant-effect decisions, and may access, correct, delete and obtain a portable copy of their data (portability up to twice a year). Controllers must act within 45 days, extendable by 45 days with notice and reasons. The first request in 12 months is free. Appeals must be decided within 45 days, extendable by 60 days, with a reference to the Attorney General.

Key points

  1. Opt-out of targeted advertising, sale and profiling in furtherance of significant-effect decisions; may be exercised through an authorized agent or technology such as a browser setting.

    Section: C.R.S. § 6-1-1306(1)(a)(I) to (II)

  2. Rights of access, correction and deletion.

    Section: C.R.S. § 6-1-1306(1)(b) to (d)

  3. Portability with access, no more than twice per calendar year.

    Section: C.R.S. § 6-1-1306(1)(e)

  4. 45 days to act, one 45-day extension with reasons.

    Section: C.R.S. § 6-1-1306(2)(a)

  5. Free on request; a fee is allowed for a second or later request in 12 months.

    Section: C.R.S. § 6-1-1306(2)(c)

  6. Appeal decided within 45 days, extendable by 60 days; consumer told they may contact the Attorney General.

    Section: C.R.S. § 6-1-1306(3)

  7. Since 1 July 2025, a right to access biometric data held about the consumer.

    Section: C.R.S. § 6-1-1314(5)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Colorado statute

Reference material, not legal advice.