Privacy laws · Colorado
Colorado Privacy Act.
Similar to VCDPA with additional requirement to honor universal opt-out mechanisms. Requires clear affirmative consent for sensitive data.
/ Diagnostic check ClearConsent scans your storefront for signals related to this law — consent banner state, GPC support, Do Not Sell links, privacy policy disclosures, cookies, and trackers.
/ Effective
2023-07-01
Effective date
When the law took effect or will take effect.
/ Consumers
100,000
Consumer threshold
The number of Colorado residents whose data triggers compliance.
/ Revenue
None
Revenue threshold
Annual revenue trigger for compliance, if applicable.
01 / Key requirements
What the law requires.
- 01Clear and conspicuous privacy notice
- 02Right to access personal data
- 03Right to correct inaccuracies
- 04Right to delete personal data
- 05Right to data portability
- 06Right to opt-out of targeted advertising
- 07Right to opt-out of sale of personal data
- 08Right to opt-out of profiling
- 09Honor universal opt-out mechanisms
- 10Data protection assessments
- 11Purpose limitation and data minimization
- 12Consent for sensitive data processing
02 / Enforcement
Penalties & cure period.
Penalties
Up to $20,000 per violation under Colorado Consumer Protection Act.
Cure period
60-day cure period (expires January 2025)
Enforcement agency
Attorney General
03 / E-commerce
What this means for
your store.
Must honor universal opt-out signals (like GPC). Similar thresholds to Virginia.