--- title: "Colorado privacy law (CPA): controller duties" canonical: "https://dposchool.com/state-privacy-laws/state/colorado/controller-duties" source: "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Colorado Privacy Act # Colorado privacy law (CPA): controller duties Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Controllers must give a clear privacy notice, specify purposes, keep collection adequate, relevant and limited to what is reasonably necessary, avoid secondary use without consent, keep data secure and avoid unlawful discrimination. They must document data protection assessments before heightened-risk processing, and separate assessments for services offered to minors. Since 1 July 2024 they must honor universal opt-out mechanisms recognized by the Attorney General, and the Attorney General's rules (4 CCR 904-3) add detailed requirements. ## Key points 1. Privacy notice: data categories, purposes, how to exercise and appeal rights, contact information, data shared with third parties and their categories. Section: [C.R.S. § 6-1-1308(1)(a)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 2. Clear and conspicuous disclosure of sale and targeted advertising and the opt-out method. Section: [C.R.S. § 6-1-1308(1)(b)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 3. Purpose specification and data minimisation (adequate, relevant and limited to what is reasonably necessary). Section: [C.R.S. § 6-1-1308(2) to (3)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 4. No secondary use without consent; reasonable security. Section: [C.R.S. § 6-1-1308(4) to (5)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 5. Universal opt-out mechanisms must be honored for targeted advertising and sale from 1 July 2024. Section: [C.R.S. § 6-1-1306(1)(a)(IV)(B)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 6. Data protection assessments for targeted advertising, risky profiling, sale and sensitive data; available to the Attorney General on request. Section: [C.R.S. § 6-1-1309(1) to (4)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) 7. Assessments and mitigation plans for services offered to minors where there is a heightened risk of harm (from 1 October 2025). Section: [C.R.S. § 6-1-1309.5](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) ## Sources - [Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) - [Colorado Attorney General, Colorado Privacy Act page](https://coag.gov/resources/colorado-privacy-act/) [Compare controller duties across all states](https://dposchool.com/state-privacy-laws/topic/controller-duties) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 35: Data protection impact assessment](https://dposchool.com/gdpr/article/35) (assessments) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Colorado statute](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf) Reference material, not legal advice. ## Other topics for Colorado - [Applicability](https://dposchool.com/state-privacy-laws/state/colorado/applicability) - [Consumer rights](https://dposchool.com/state-privacy-laws/state/colorado/consumer-rights) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data) - [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/colorado/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Colorado](https://dposchool.com/state-privacy-laws/state/colorado) / Controller duties Previous: [Sensitive data](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data) Next: [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents