Colorado Privacy Act
Colorado privacy law (CPA): sensitive data
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
Summary (not the statute text)
Sensitive data covers racial or ethnic origin, religious beliefs, health conditions, sex life or sexual orientation, citizenship status, genetic or biometric data used to identify a person, data of a known child, biological data including neural data, and (since 23 May 2025) precise geolocation data. Controllers need prior consent to process or sell sensitive data, and a parent's consent for a known child under 13. Since 1 October 2025, controllers offering online services to known minors under 18 need consent before targeted advertising, sale, significant-effect profiling, engagement-extending design or precise geolocation collection.
Key points
Sensitive data definition, including biological and neural data.
Section: C.R.S. § 6-1-1303(24)
Precise geolocation (within 1,850 feet) added to sensitive data.
Prior consent required to process or sell sensitive data; parental consent for a known child.
Section: C.R.S. § 6-1-1308(7)
Child means under 13; minor means under 18.
Section: C.R.S. § 6-1-1303(4), (16.5)
For known minors: duty of reasonable care, and consent needed (the minor's, or a parent's if under 13) for targeted ads, sale, significant-effect profiling, use-extending design features and precise geolocation.
Section: C.R.S. § 6-1-1308.5(1) to (3)
Biometric identifiers: consent before collection, retention and deletion policy, limits on sale.
Section: C.R.S. § 6-1-1314
Sources
Compare sensitive data across all states
Related GDPR articles
Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.
- Article 9: Processing of special categories of personal data (sensitive data)
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Colorado statute
Reference material, not legal advice.