DPO SchoolDPO School

Colorado Privacy Act

Colorado privacy law (CPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General and district attorneys enforce the Act; violations are deceptive trade practices under the Colorado Consumer Protection Act. The general 60-day cure period was repealed on 1 January 2025, but a 60-day cure still applies to the minors' provisions until 31 December 2026. Civil penalties are up to $20,000 per violation, counted per consumer or transaction, and up to $50,000 where the victim is elderly. There is no private right of action.

Key points

  1. Exclusive enforcement by the Attorney General and district attorneys.

    Section: C.R.S. § 6-1-1311(1)(a)

  2. Violations are deceptive trade practices for enforcement purposes.

    Section: C.R.S. § 6-1-1311(1)(c)

  3. General 60-day cure repealed effective 1 January 2025.

    Section: C.R.S. § 6-1-1311(1)(d)(I)

  4. 60-day cure for the minors' provisions, repealed effective 31 December 2026.

    Section: C.R.S. § 6-1-1311(1)(d)(II)

  5. Civil penalty up to $20,000 per violation, each consumer or transaction a separate violation.

    Section: C.R.S. § 6-1-112(1)(a)

  6. Up to $50,000 per violation against an elderly person.

    Section: C.R.S. § 6-1-112(1)(c)

  7. No private right of action.

    Section: C.R.S. § 6-1-1310(1)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Colorado statute

Reference material, not legal advice.