US — ColoradoColorado Privacy Act (CPA): Complete Compliance Guide
Overview
The Colorado Privacy Act (CPA) is a state-level data privacy regulation that empowers Colorado residents to control their personal data. Enacted in 2021, it provides consumers with rights such as access, correction, deletion, and opt-out options related to their data. The CPA also requires businesses to handle personal data responsibly, ensuring transparency and accountability in how they process personal information.
The CPA Final Rules, which provide further details on compliance requirements, were finalized and came into effect on July 1, 2024.
Does the Colorado Privacy Act Apply to Your Business?
The CPA applies to businesses that meet at least one of its thresholds. Use this tool to check whether it applies to yours.
Colorado Privacy Act Scope Checker
Answer two questions to determine whether the CPA applies to your organization.
Note: the CPA applies based on Colorado residents' data, regardless of where your business is located.
Colorado Consumer Rights Under the CPA
The CPA grants six individual privacy rights to Colorado residents. Businesses must respond to authenticated requests within 45 days. A 45-day extension is available with written notice to the consumer.
Request access to the information we have collected about you
45-day response windowCorrect inaccurate or incomplete information we have collected about you
45-day response windowDelete personal information we have collected about you
45-day response windowRequest a copy of personal information we have collected about you
45-day response windowRequest that we stop selling your personal information
45-day response windowOpt-out of targeted advertisements so that you no longer receive personalized ads
45-day response windowHow Clym Helps You Comply with the Colorado Privacy Act
Clym detects browser-based Global Privacy Control signals and automatically applies opt-out status — no extra configuration needed from your dev team.
Configurable consent banner with a clear opt-out for targeted ads and data sales, and a full consent audit log.
Clym's Data Subject Request portal handles every CPA request type, with built-in 45-day deadline tracking and escalation alerts.
Clym scans your site and generates your CPA-compliant privacy notice, updated automatically when new trackers or data categories are detected.
Regulation Summary
- March 2, 2021: CPA introduced in the Senate.
- July 7, 2021: Signed into law.
- July 1, 2023: CPA became enforceable.
- Businesses conducting operations in Colorado or targeting Colorado residents.
- Businesses that either:
- Process data of 100,000+ consumers annually.
- Derive revenue from selling personal data of 25,000+ consumers.
- Health-related data covered by HIPAA.
- Data governed by federal regulations (e.g., Fair Credit Reporting Act, GLBA, COPPA).
- Data used for personal, household, or employee purposes.
- Data Minimization: Only collect data necessary for the stated purpose.
- Transparency: Provide privacy notices detailing data collection practices.
- Purpose Limitation: Avoid using data for secondary purposes unless consented.
- Security: Implement safeguards appropriate to the data’s nature.
- Non-discrimination: Do not deny services or provide inferior service based on privacy rights exercise.
- Opt-Out Mechanism: Provide a user-friendly way for consumers to opt out of targeted advertising, data sales, and profiling.
- Privacy Notices: Display clear and accessible privacy disclosures.
- Universal Opt-Out: From July 1, 2024, honor user-selected universal opt-out mechanisms.
- Data Protection Assessments: Required for activities that pose heightened risks (e.g., targeted advertising, sensitive data processing).
- Sensitive Data: Obtain consent before processing sensitive data (e.g., health information, racial/ethnic origin).
- Access: Confirm and obtain a copy of personal data.
- Correction: Request corrections to inaccurate data.
- Deletion: Request data deletion.
- Portability: Receive personal data in a machine-readable format.
- Opt-Out: Refuse data processing for targeted advertising, data sales, or profiling.
- Enforced by the Colorado Attorney General and District Attorneys.
- No private right of action (individual lawsuits).
- Fines: Up to $20,000 per violation, depending on severity.