--- title: "Colorado privacy law (CPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/colorado/consumer-rights" source: "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Colorado Privacy Act # Colorado privacy law (CPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may opt out of targeted advertising, sale and profiling for significant-effect decisions, and may access, correct, delete and obtain a portable copy of their data (portability up to twice a year). Controllers must act within 45 days, extendable by 45 days with notice and reasons. The first request in 12 months is free. Appeals must be decided within 45 days, extendable by 60 days, with a reference to the Attorney General. ## Key points 1. Opt-out of targeted advertising, sale and profiling in furtherance of significant-effect decisions; may be exercised through an authorized agent or technology such as a browser setting. Section: [C.R.S. § 6-1-1306(1)(a)(I) to (II)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 2. Rights of access, correction and deletion. Section: [C.R.S. § 6-1-1306(1)(b) to (d)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 3. Portability with access, no more than twice per calendar year. Section: [C.R.S. § 6-1-1306(1)(e)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 4. 45 days to act, one 45-day extension with reasons. Section: [C.R.S. § 6-1-1306(2)(a)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 5. Free on request; a fee is allowed for a second or later request in 12 months. Section: [C.R.S. § 6-1-1306(2)(c)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 6. Appeal decided within 45 days, extendable by 60 days; consumer told they may contact the Attorney General. Section: [C.R.S. § 6-1-1306(3)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 7. Since 1 July 2025, a right to access biometric data held about the consumer. Section: [C.R.S. § 6-1-1314(5)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) ## Sources - [Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Colorado statute](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) Reference material, not legal advice. ## Other topics for Colorado - [Applicability](https://dposchool.com/state-privacy-laws/state/colorado/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/colorado/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/colorado/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Colorado](https://dposchool.com/state-privacy-laws/state/colorado) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/colorado/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents