Overview
The Colorado Privacy Act (CPA) is a comprehensive data privacy law that grants Colorado residents new rights over their personal data and imposes strict compliance requirements on businesses. Signed into law in July 2021, the CPA took effect on July 1, 2023, making Colorado the third U.S. state (after California and Virginia) to enact broad consumer privacy protections.
The CPA is influenced by GDPR and CPRA, with a focus on consumer rights, business transparency, and data security.
Who Must Comply?
The CPA applies to companies that conduct business in Colorado or target Colorado residents and meet one of the following criteria:
✔ Control or process personal data of at least 100,000 consumers annually
✔ Control or process personal data of at least 25,000 consumers and derive revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government entities
🚫 Nonprofits
🚫 Financial institutions covered under GLBA
🚫 Health entities subject to HIPAA
🚫 Higher education institutions
Key Consumer Rights Under CPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Correct – Consumers can request corrections to their personal data.
✔ Right to Delete – Consumers can request deletion of their personal data.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
- Certain types of profiling
Business Compliance Requirements
✔ Universal Opt-Out Mechanism – As of July 1, 2024, businesses must honor universal opt-out signals (e.g., Global Privacy Control).
✔ Data Protection Assessments (DPA) – Businesses must conduct risk assessments before processing sensitive data.
✔ Obtain Consent for Sensitive Data – Businesses must receive explicit user consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Health conditions
📌 Biometric data
📌 Sexual orientation
📌 Children’s data
✔ Clear Privacy Notices – Companies must publish detailed privacy policies.
✔ Purpose Limitation – Businesses cannot collect more data than necessary for their stated purpose.
✔ Data Security Standards – Businesses must use reasonable measures to protect personal data.
Real-World Enforcement Cases
Colorado’s Attorney General enforces the CPA, with penalties of up to $20,000 per violation. While major enforcement actions are still developing, similar state laws (like CPRA) suggest that adtech, e-commerce, and data brokers will be early enforcement targets.
📌 Comparison with CPRA (California Privacy Rights Act)
The Colorado CPA differs from California’s CPRA in key ways:
✅ Stronger Universal Opt-Out Rules – Companies must recognize global privacy controls.
✅ No Private Right of Action – Consumers cannot directly sue businesses for violations.
✅ Stricter Consent Rules for Sensitive Data – CPA requires opt-in consent, unlike CPRA.
Future of CPA Regulation
📌 Tighter enforcement of universal opt-out signals by mid-2024
📌 Stronger penalties for companies violating opt-out requirements
📌 More restrictions on AI-driven consumer profiling
Colorado’s CPA sets a higher compliance bar than many other state laws, particularly with its opt-out enforcement mechanisms.
