Laws & Statutes › CO › CO-SB-21-190
SB-21-190
CO · State · USA
CO
USA
● Enacted
Effective Date
2023-07-01
Colorado Senate Bill 21-190 — Colorado Privacy Act (Part 13, Article 1, Title 6, Colorado Revised Statutes)
The Colorado Privacy Act (CPA) is a comprehensive consumer data privacy law that applies to controllers conducting business in Colorado or intentionally targeting Colorado residents and meeting specified data processing thresholds (100,000+ consumers or 25,000+ consumers with revenue from data sales). It grants Colorado consumers rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, data sales, and profiling for consequential decisions. Controllers must provide transparent privacy notices, practice data minimization, obtain consent before processing sensitive data, and conduct data protection assessments for high-risk processing activities. Enforcement is exclusively by the Attorney General and district attorneys, who treat violations as deceptive trade practices; no private right of action exists. The law includes extensive exemptions for HIPAA-covered entities, GLBA-regulated financial institutions, and other federally regulated data categories.
Mapped Requirements
D-01 Automated Processing Rights & Data Controls H-02 Non-Discrimination & Bias Assessment R-02 Regulatory Disclosure & Submissions
Entry Last Reviewed
2026-04-02
AI generated
Summary

The Colorado Privacy Act (CPA) is a comprehensive consumer data privacy law that applies to controllers conducting business in Colorado or intentionally targeting Colorado residents and meeting specified data processing thresholds (100,000+ consumers or 25,000+ consumers with revenue from data sales). It grants Colorado consumers rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, data sales, and profiling for consequential decisions. Controllers must provide transparent privacy notices, practice data minimization, obtain consent before processing sensitive data, and conduct data protection assessments for high-risk processing activities. Enforcement is exclusively by the Attorney General and district attorneys, who treat violations as deceptive trade practices; no private right of action exists. The law includes extensive exemptions for HIPAA-covered entities, GLBA-regulated financial institutions, and other federally regulated data categories.

Enforcement & Penalties
Enforcement Authority
Attorney General and district attorneys have exclusive authority to enforce by bringing an action in the name of the state or as parens patriae on behalf of Colorado residents. Enforcement is agency-initiated. Violations are treated as deceptive trade practices under Colorado's Consumer Protection Act (§ 6-1-105). Prior to January 1, 2025, enforcement actions required a 60-day cure notice before suit could be brought. After January 1, 2025, the cure period is repealed and the AG/DA may proceed directly. No private right of action is authorized.
Penalties
Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act. The AG or district attorney may seek injunctive relief, temporary restraining orders, restitution to restore injured persons to their original position, disgorgement to prevent unjust enrichment, and civil penalties. Civil penalty receipts are credited per § 24-31-108. No statutory minimum per-violation amount is specified in the CPA itself; penalties are set by the court. No private damages remedy exists.
Who Is Covered
"Controller" means a person that, alone or jointly with others, determines the purposes for and means of processing personal data.
"Processor" means a person that processes personal data on behalf of a controller.
Compliance Obligations 14 obligations · click obligation ID to open requirement page
D-01 Automated Processing Rights & Data Controls · D-01.3 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1306(1)(a)
Plain Language
Colorado consumers have the right to opt out of three categories of data processing: targeted advertising, the sale of personal data, and profiling used to make consequential decisions (covering financial services, housing, insurance, education, employment, healthcare, and essential goods/services). Controllers that engage in targeted advertising or data sales must provide a clear and conspicuous opt-out method both in and outside the privacy notice. Starting July 1, 2024, controllers must also honor a user-selected universal opt-out mechanism meeting AG specifications. However, a controller may obtain specific, informed consent that overrides the universal opt-out — but only after providing clear notice of available choices and enabling equally easy revocation of that consent. Authorized agents may exercise opt-out rights on behalf of consumers.
Statutory Text
(a) Right to opt out. (I) A consumer has the right to opt out of the processing of personal data concerning the consumer for purposes of: (A) Targeted advertising; (B) The sale of personal data; or (C) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer. (II) A consumer may authorize another person, acting on the consumer's behalf, to opt out of the processing of the consumer's personal data for one or more of the purposes specified in subsection (1)(a)(I) of this section, including through a technology indicating the consumer's intent to opt out such as a web link indicating a preference or browser setting, browser extension, or global device setting. A controller shall comply with an opt-out request received from a person authorized by the consumer to act on the consumer's behalf if the controller is able to authenticate, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf. (III) A controller that processes personal data for purposes of targeted advertising or the sale of personal data shall provide a clear and conspicuous method to exercise the right to opt out of the processing of personal data concerning the consumer pursuant to subsection (1)(a)(I) of this section. The controller shall provide the opt-out method clearly and conspicuously in any privacy notice required to be provided to consumers under this part 13, and in a clear, conspicuous, and readily accessible location outside the privacy notice. (IV) (A) A controller that processes personal data for purposes of targeted advertising or the sale of personal data may allow consumers to exercise the right to opt out of the processing of personal data concerning the consumer for purposes of targeted advertising or the sale of personal data pursuant to subsections (1)(a)(I)(A) and (1)(a)(I)(B) of this section by controllers through a user-selected universal opt-out mechanism that meets the technical specifications established by the attorney general pursuant to section 6-1-1313. This subsection (1)(a)(IV)(A) is repealed, effective July 1, 2024. (B) Effective July 1, 2024, a controller that processes personal data for purposes of targeted advertising or the sale of personal data shall allow consumers to exercise the right to opt out of the processing of personal data concerning the consumer for purposes of targeted advertising or the sale of personal data pursuant to subsections (1)(a)(I)(A) and (1)(a)(I)(B) of this section by controllers through a user-selected universal opt-out mechanism that meets the technical specifications established by the attorney general pursuant to section 6-1-1313. (C) Notwithstanding a consumer's decision to exercise the right to opt out of the processing of personal data through a universal opt-out mechanism pursuant to subsection (1)(a)(IV)(B) of this section, a controller may enable the consumer to consent, through a web page, application, or a similar method, to the processing of the consumer's personal data for purposes of targeted advertising or the sale of personal data, and the consent takes precedence over any choice reflected through the universal opt-out mechanism. Before obtaining a consumer's consent to process personal data for purposes of targeted advertising or the sale of personal data pursuant to this subsection (1)(a)(IV)(C), a controller shall provide the consumer with a clear and conspicuous notice informing the consumer about the choices available under this section, describing the categories of personal data to be processed and the purposes for which they will be processed, and explaining how and where the consumer may withdraw consent. The web page, application, or other means by which a controller obtains a consumer's consent to process personal data for purposes of targeted advertising or the sale of personal data must also allow the consumer to revoke the consent as easily as it is affirmatively provided.
D-01 Automated Processing Rights & Data Controls · D-01.1D-01.2 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1306(1)(b)-(e)
Plain Language
Consumers have four core data rights: (1) the right to confirm whether their data is being processed and to access it; (2) the right to correct inaccuracies; (3) the right to delete their personal data; and (4) the right to data portability — receiving their data in a portable, usable format to transmit to another entity (limited to twice per calendar year, with a trade secret carve-out). These rights must be exercised through the methods described in the controller's privacy notice.
Statutory Text
(b) Right of access. A consumer has the right to confirm whether a controller is processing personal data concerning the consumer and to access the consumer's personal data. (c) Right to correction. A consumer has the right to correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data. (d) Right to deletion. A consumer has the right to delete personal data concerning the consumer. (e) Right to data portability. When exercising the right to access personal data pursuant to subsection (1)(b) of this section, a consumer has the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance. A consumer may exercise this right no more than two times per calendar year. Nothing in this subsection (1)(e) requires a controller to provide the data to the consumer in a manner that would disclose the controller's trade secrets.
D-01 Automated Processing Rights & Data Controls · D-01.4 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(3)-(4)
Plain Language
Controllers must limit their data collection to what is adequate, relevant, and reasonably necessary for the stated processing purposes. They may not repurpose personal data for secondary uses that are incompatible with the original stated purposes unless the consumer provides fresh consent. These are foundational data minimization and purpose limitation obligations that apply across all data processing activities.
Statutory Text
(3) Duty of data minimization. A controller's collection of personal data must be adequate, relevant, and limited to what is reasonably necessary in relation to the specified purposes for which the data are processed. (4) Duty to avoid secondary use. A controller shall not process personal data for purposes that are not reasonably necessary to or compatible with the specified purposes for which the personal data are processed, unless the controller first obtains the consumer's consent.
D-01 Automated Processing Rights & Data Controls · D-01.5 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(7)
Plain Language
Controllers must obtain affirmative, informed consent before processing any sensitive data — including data revealing race, ethnicity, religion, health conditions, sex life, sexual orientation, citizenship, genetic data, biometric data, or data from known children. For children's data, consent must come from a parent or lawful guardian. Consent must be freely given, specific, informed, and unambiguous; bundled terms-of-service acceptance, passive interactions, and dark patterns do not qualify.
Statutory Text
(7) Duty regarding sensitive data. A controller shall not process a consumer's sensitive data without first obtaining the consumer's consent or, in the case of the processing of personal data concerning a known child, without first obtaining consent from the child's parent or lawful guardian.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(1)(a)-(b)
Plain Language
Controllers must publish a reasonably accessible, clear privacy notice that covers: what categories of personal data are collected, why, how consumers can exercise their rights (with contact info and appeal instructions), what data categories are shared with third parties, and which categories of third parties receive data. If the controller sells data or uses it for targeted advertising, that must be clearly and conspicuously disclosed along with opt-out instructions. This is a foundational transparency obligation — there is no AI-specific analog in the taxonomy.
Statutory Text
(1) Duty of transparency. (a) A controller shall provide consumers with a reasonably accessible, clear, and meaningful privacy notice that includes: (I) The categories of personal data collected or processed by the controller or a processor; (II) The purposes for which the categories of personal data are processed; (III) How and where consumers may exercise the rights pursuant to section 6-1-1306, including the controller's contact information and how a consumer may appeal a controller's action with regard to the consumer's request; (IV) The categories of personal data that the controller shares with third parties, if any; and (V) The categories of third parties, if any, with whom the controller shares personal data. (b) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose the sale or processing, as well as the manner in which a consumer may exercise the right to opt out of the sale or processing.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(1)(c)-(d)
Plain Language
Controllers cannot punish consumers for exercising their data rights — they may not require new account creation, raise prices, or reduce service availability solely because a consumer opted out or exercised other rights. However, controllers may offer differentiated pricing or service tiers tied to voluntary participation in bona fide loyalty or rewards programs, and are not required to provide services that depend on data they no longer collect.
Statutory Text
(c) A controller shall not: (I) Require a consumer to create a new account in order to exercise a right; or (II) Based solely on the exercise of a right and unrelated to feasibility or the value of a service, increase the cost of, or decrease the availability of, the product or service. (d) Nothing in this part 13 shall be construed to require a controller to provide a product or service that requires the personal data of a consumer that the controller does not collect or maintain or to prohibit a controller from offering a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the offer is related to a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discount, or club card program.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1306(2)-(3)
Plain Language
Controllers must respond to consumer data rights requests within 45 days (extendable by 45 more days with notice), provide the first response free of charge, and explain reasons for any denial with appeal instructions. Controllers must maintain an internal appeal process that is equally accessible and easy to use. Appeals must be resolved within 45 days (extendable by 60 more), with written explanations. Consumers must be informed of their ability to contact the Attorney General if dissatisfied with an appeal outcome. Authentication failures excuse compliance, but controllers must request additional information before declining.
Statutory Text
(2) Responding to consumer requests. (a) A controller shall inform a consumer of any action taken on a request under subsection (1) of this section without undue delay and, in any event, within forty-five days after receipt of the request. The controller may extend the forty-five-day period by forty-five additional days where reasonably necessary, taking into account the complexity and number of the requests. The controller shall inform the consumer of an extension within forty-five days after receipt of the request, together with the reasons for the delay. (b) If a controller does not take action on the request of a consumer, the controller shall inform the consumer, without undue delay and, at the latest, within forty-five days after receipt of the request, of the reasons for not taking action and instructions for how to appeal the decision with the controller as described in subsection (3) of this section. (c) Upon request, a controller shall provide to the consumer the information specified in this section free of charge; except that, for a second or subsequent request within a twelve-month period, the controller may charge an amount calculated in the manner specified in section 24-72-205 (5)(a). (d) A controller is not required to comply with a request to exercise any of the rights under subsection (1) of this section if the controller is unable to authenticate the request using commercially reasonable efforts, in which case the controller may request the provision of additional information reasonably necessary to authenticate the request. (3) (a) A controller shall establish an internal process whereby consumers may appeal a refusal to take action on a request to exercise any of the rights under subsection (1) of this section within a reasonable period after the consumer's receipt of the notice sent by the controller under subsection (2)(b) of this section. The appeal process must be conspicuously available and as easy to use as the process for submitting a request under this section. (b) Within forty-five days after receipt of an appeal, a controller shall inform the consumer of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response. The controller may extend the forty-five-day period by sixty additional days where reasonably necessary, taking into account the complexity and number of requests serving as the basis for the appeal. The controller shall inform the consumer of an extension within forty-five days after receipt of the appeal, together with the reasons for the delay. (c) The controller shall inform the consumer of the consumer's ability to contact the attorney general if the consumer has concerns about the result of the appeal.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(2)
Plain Language
Controllers must clearly specify the purposes for which they collect and process personal data. This is a foundational purpose limitation obligation that constrains both data collection (via the data minimization duty) and secondary use (via the secondary use prohibition). The specification must be express, not implied.
Statutory Text
(2) Duty of purpose specification. A controller shall specify the express purposes for which personal data are collected and processed.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(5)
Plain Language
Controllers must implement reasonable security measures to protect personal data from unauthorized acquisition, both during storage and active use. The security measures must be proportionate to the volume, scope, and nature of the data processed and the nature of the business. This is a general data security obligation, not limited to AI systems.
Statutory Text
(5) Duty of care. A controller shall take reasonable measures to secure personal data during both storage and use from unauthorized acquisition. The data security practices must be appropriate to the volume, scope, and nature of the personal data processed and the nature of the business.
H-02 Non-Discrimination & Bias Assessment · H-02.3 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1309(1)-(6)
Plain Language
Controllers must conduct and document a data protection assessment before engaging in any processing activity that poses heightened risk to consumers — specifically: targeted advertising, profiling that risks disparate impact or substantial injury, selling personal data, or processing sensitive data. Each assessment must weigh the benefits of the processing against risks to consumers, factoring in safeguards, de-identification, consumer expectations, and the controller-consumer relationship. Assessments must be made available to the AG upon request but are confidential and exempt from open records laws; disclosure to the AG does not waive privilege. A single assessment may cover comparable processing operations. The requirement applies only to processing activities created after July 1, 2023.
Statutory Text
(1) A controller shall not conduct processing that presents a heightened risk of harm to a consumer without conducting and documenting a data protection assessment of each of its processing activities that involve personal data acquired on or after the effective date of this section that present a heightened risk of harm to a consumer. (2) For purposes of this section, "processing that presents a heightened risk of harm to a consumer" includes the following: (a) Processing personal data for purposes of targeted advertising or for profiling if the profiling presents a reasonably foreseeable risk of: (I) Unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (II) Financial or physical injury to consumers; (III) A physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers if the intrusion would be offensive to a reasonable person; or (IV) Other substantial injury to consumers; (b) Selling personal data; and (c) Processing sensitive data. (3) Data protection assessments must identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards that the controller can employ to reduce the risks. The controller shall factor into this assessment the use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed. (4) A controller shall make the data protection assessment available to the attorney general upon request. The attorney general may evaluate the data protection assessment for compliance with the duties contained in section 6-1-1308 and with other laws, including this article 1. Data protection assessments are confidential and exempt from public inspection and copying under the "Colorado Open Records Act", part 2 of article 72 of title 24. The disclosure of a data protection assessment pursuant to a request from the attorney general under this subsection (4) does not constitute a waiver of any attorney-client privilege or work-product protection that might otherwise exist with respect to the assessment and any information contained in the assessment. (5) A single data protection assessment may address a comparable set of processing operations that include similar activities. (6) Data protection assessment requirements apply to processing activities created or generated after July 1, 2023, and are not retroactive.
Other · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1305(2)-(8)
Plain Language
Processors must follow controller instructions and assist with consumer rights requests, data security, breach notification, and data protection assessments. Every processor relationship must be governed by a binding contract specifying processing instructions, data types, duration, and mandatory terms including: confidentiality duties for all personnel, subcontractor controls (with controller objection rights), data deletion/return at service end, compliance demonstration obligations, and audit rights. Controllers and processors must implement appropriate security measures with clear responsibility allocation. Processors may satisfy audit requirements through independent third-party audits at least annually using accepted control standards.
Statutory Text
(2) Processors shall adhere to the instructions of the controller and assist the controller to meet its obligations under this part 13. Taking into account the nature of processing and the information available to the processor, the processor shall assist the controller by: (a) Taking appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the controller's obligation to respond to consumer requests to exercise their rights pursuant to section 6-1-1306; (b) Helping to meet the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of the security of the system pursuant to section 6-1-716; and (c) Providing information to the controller necessary to enable the controller to conduct and document any data protection assessments required by section 6-1-1309. The controller and processor are each responsible for only the measures allocated to them. (3) Notwithstanding the instructions of the controller, a processor shall: (a) Ensure that each person processing the personal data is subject to a duty of confidentiality with respect to the data; and (b) Engage a subcontractor only after providing the controller with an opportunity to object and pursuant to a written contract in accordance with subsection (5) of this section that requires the subcontractor to meet the obligations of the processor with respect to the personal data. (4) Taking into account the context of processing, the controller and the processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk and establish a clear allocation of the responsibilities between them to implement the measures. (5) Processing by a processor must be governed by a contract between the controller and the processor that is binding on both parties and that sets out: (a) The processing instructions to which the processor is bound, including the nature and purpose of the processing; (b) The type of personal data subject to the processing, and the duration of the processing; (c) The requirements imposed by this subsection (5) and subsections (3) and (4) of this section; and (d) The following requirements: (I) At the choice of the controller, the processor shall delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law; (II) (A) The processor shall make available to the controller all information necessary to demonstrate compliance with the obligations in this part 13; and (B) The processor shall allow for, and contribute to, reasonable audits and inspections by the controller or the controller's designated auditor. Alternatively, the processor may, with the controller's consent, arrange for a qualified and independent auditor to conduct, at least annually and at the processor's expense, an audit of the processor's policies and technical and organizational measures in support of the obligations under this part 13 using an appropriate and accepted control standard or framework and audit procedure for the audits as applicable. The processor shall provide a report of the audit to the controller upon request.
H-02 Non-Discrimination & Bias Assessment · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1308(6)
Plain Language
Controllers must ensure their personal data processing does not violate existing state or federal anti-discrimination laws. This is a pass-through obligation — it does not create a new anti-discrimination standard but confirms that CPA-covered controllers remain subject to all existing discrimination prohibitions when processing personal data.
Statutory Text
(6) Duty to avoid unlawful discrimination. A controller shall not process personal data in violation of state or federal laws that prohibit unlawful discrimination against consumers.
R-02 Regulatory Disclosure & Submissions · R-02.2 · Deployer · Automated Decisionmaking
C.R.S. § 6-1-1309(4)
Plain Language
Controllers must produce their data protection assessments to the Attorney General upon request. The AG may evaluate them for compliance with controller duties and other applicable laws. Assessments are confidential and exempt from open records requests. Disclosure to the AG does not waive attorney-client privilege or work-product protection. This is a regulatory submission obligation separate from the duty to conduct the assessment itself.
Statutory Text
(4) A controller shall make the data protection assessment available to the attorney general upon request. The attorney general may evaluate the data protection assessment for compliance with the duties contained in section 6-1-1308 and with other laws, including this article 1. Data protection assessments are confidential and exempt from public inspection and copying under the "Colorado Open Records Act", part 2 of article 72 of title 24. The disclosure of a data protection assessment pursuant to a request from the attorney general under this subsection (4) does not constitute a waiver of any attorney-client privilege or work-product protection that might otherwise exist with respect to the assessment and any information contained in the assessment.
Other · Automated Decisionmaking
C.R.S. § 6-1-1310(1) and § 6-1-1311(1)(a)-(d)
Plain Language
No private right of action exists under the CPA. The AG and district attorneys are the exclusive enforcers, treating violations as deceptive trade practices. Prior to January 1, 2025, a 60-day cure notice was required before enforcement action could be brought (if a cure was deemed possible). After January 1, 2025, the cure period is repealed. This provision creates no new compliance obligation — it defines the enforcement mechanism.
Statutory Text
6-1-1310. Liability. (1) Notwithstanding any provision in part 1 of this article 1, this part 13 does not authorize a private right of action for a violation of this part 13 or any other provision of law. This subsection (1) neither relieves any party from any duties or obligations imposed, nor alters any independent rights that consumers have, under other laws, including this article 1, the state constitution, or the United States constitution. 6-1-1311. Enforcement - penalties - repeal. (1) (a) Notwithstanding any other provision of this article 1, the attorney general and district attorneys have exclusive authority to enforce this part 13 by bringing an action in the name of the state or as parens patriae on behalf of persons residing in the state to enforce this part 13 as provided in this article 1, including seeking an injunction to enjoin a violation of this part 13. (b) Notwithstanding any other provision of this article 1, nothing in this part 13 shall be construed as providing the basis for, or being subject to, a private right of action for violations of this part 13 or any other law. (c) For purposes only of enforcement of this part 13 by the attorney general or a district attorney, a violation of this part 13 is a deceptive trade practice. (d) Prior to any enforcement action pursuant to subsection (1)(a) of this section, the attorney general or district attorney must issue a notice of violation to the controller if a cure is deemed possible. If the controller fails to cure the violation within sixty days after receipt of the notice of violation, an action may be brought pursuant to this section. This subsection (1)(d) is repealed, effective January 1, 2025.