Colorado privacy law (CPA): controller duties

Key points

1. Privacy notice: data categories, purposes, how to exercise and appeal rights, contact information, data shared with third parties and their categories.

   Section: C.R.S. § 6-1-1308(1)(a)

2. Clear and conspicuous disclosure of sale and targeted advertising and the opt-out method.

   Section: C.R.S. § 6-1-1308(1)(b)

3. Purpose specification and data minimisation (adequate, relevant and limited to what is reasonably necessary).

   Section: C.R.S. § 6-1-1308(2) to (3)

4. No secondary use without consent; reasonable security.

   Section: C.R.S. § 6-1-1308(4) to (5)

5. Universal opt-out mechanisms must be honored for targeted advertising and sale from 1 July 2024.

   Section: C.R.S. § 6-1-1306(1)(a)(IV)(B)

6. Data protection assessments for targeted advertising, risky profiling, sale and sensitive data; available to the Attorney General on request.

   Section: C.R.S. § 6-1-1309(1) to (4)

7. Assessments and mitigation plans for services offered to minors where there is a heightened risk of harm (from 1 October 2025).

   Section: C.R.S. § 6-1-1309.5

Sources

• Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)
• Colorado Attorney General, Colorado Privacy Act page

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

• Article 35: Data protection impact assessment (assessments)