Privacy Laws
Colorado
CO
Colorado Privacy Act
CPA
Similar to VCDPA with additional requirement to honor universal opt-out mechanisms. Requires clear affirmative consent for sensitive data.
Effective Date
2023-07-01
Enforcement
Attorney General
Consumer Threshold
100,000 consumers
Revenue Threshold
No threshold
Key Requirements
Clear and conspicuous privacy notice
Right to access personal data
Right to correct inaccuracies
Right to delete personal data
Right to data portability
Right to opt-out of targeted advertising
Right to opt-out of sale of personal data
Right to opt-out of profiling
Honor universal opt-out mechanisms
Data protection assessments
Purpose limitation and data minimization
Consent for sensitive data processing
Penalties
Up to $20,000 per violation under Colorado Consumer Protection Act.
Cure Period
60-day cure period (expires January 2025)
E-commerce Relevance
Must honor universal opt-out signals (like GPC). Similar thresholds to Virginia.