---
title: "Colorado privacy law (CPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/colorado/sensitive-data"
source: "https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Colorado Privacy Act

# Colorado privacy law (CPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, health conditions, sex life or sexual orientation, citizenship status, genetic or biometric data used to identify a person, data of a known child, biological data including neural data, and (since 23 May 2025) precise geolocation data. Controllers need prior consent to process or sell sensitive data, and a parent's consent for a known child under 13. Since 1 October 2025, controllers offering online services to known minors under 18 need consent before targeted advertising, sale, significant-effect profiling, engagement-extending design or precise geolocation collection.

## Key points

1. Sensitive data definition, including biological and neural data.

   Section: [C.R.S. § 6-1-1303(24)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

2. Precise geolocation (within 1,850 feet) added to sensitive data.

   Section: [C.R.S. § 6-1-1303(17.4), (24)(e) (SB 25-276)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

3. Prior consent required to process or sell sensitive data; parental consent for a known child.

   Section: [C.R.S. § 6-1-1308(7)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

4. Child means under 13; minor means under 18.

   Section: [C.R.S. § 6-1-1303(4), (16.5)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

5. For known minors: duty of reasonable care, and consent needed (the minor's, or a parent's if under 13) for targeted ads, sale, significant-effect profiling, use-extending design features and precise geolocation.

   Section: [C.R.S. § 6-1-1308.5(1) to (3)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

6. Biometric identifiers: consent before collection, retention and deletion policy, limits on sale.

   Section: [C.R.S. § 6-1-1314](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

## Sources

- [Colorado Revised Statutes 2024, Title 6 (uncertified OLLS printout), Part 13 of Article 1 and § 6-1-112 (statute text only used)](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)
- [SB 25-276 signed act (PDF)](https://leg.colorado.gov/bill_files/40789/download)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Colorado statute](https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf)

Reference material, not legal advice.

## Other topics for Colorado

- [Applicability](https://dposchool.com/state-privacy-laws/state/colorado/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/colorado/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/colorado/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/colorado/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/colorado/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Colorado](https://dposchool.com/state-privacy-laws/state/colorado) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/colorado/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/colorado/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents