---
title: "Colorado privacy law (CPA): enforcement"
canonical: "https://dposchool.com/state-privacy-laws/state/colorado/enforcement"
source: "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Colorado Privacy Act

# Colorado privacy law (CPA): enforcement

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

The Attorney General and district attorneys enforce the Act; violations are deceptive trade practices under the Colorado Consumer Protection Act. The general 60-day cure period was repealed on 1 January 2025, but a 60-day cure still applies to the minors' provisions until 31 December 2026. Civil penalties are up to $20,000 per violation, counted per consumer or transaction, and up to $50,000 where the victim is elderly. There is no private right of action.

## Key points

1. Exclusive enforcement by the Attorney General and district attorneys.

   Section: [C.R.S. § 6-1-1311(1)(a)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

2. Violations are deceptive trade practices for enforcement purposes.

   Section: [C.R.S. § 6-1-1311(1)(c)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

3. General 60-day cure repealed effective 1 January 2025.

   Section: [C.R.S. § 6-1-1311(1)(d)(I)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

4. 60-day cure for the minors' provisions, repealed effective 31 December 2026.

   Section: [C.R.S. § 6-1-1311(1)(d)(II)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

5. Civil penalty up to $20,000 per violation, each consumer or transaction a separate violation.

   Section: [C.R.S. § 6-1-112(1)(a)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

6. Up to $50,000 per violation against an elderly person.

   Section: [C.R.S. § 6-1-112(1)(c)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

7. No private right of action.

   Section: [C.R.S. § 6-1-1310(1)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

## Sources

- [Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

[Compare enforcement across all states](https://dposchool.com/state-privacy-laws/topic/enforcement)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 83: General conditions for imposing administrative fines](https://dposchool.com/gdpr/article/83) (enforcement)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Colorado statute](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

Reference material, not legal advice.

## Other topics for Colorado

- [Applicability](https://dposchool.com/state-privacy-laws/state/colorado/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/colorado/consumer-rights)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/colorado/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Colorado](https://dposchool.com/state-privacy-laws/state/colorado) / Enforcement

Previous: [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents