Colorado Privacy Act (CPA)

The Colorado Privacy Act (CPA) provides Colorado residents with rights over their personal data, including the right to opt-out of data processing for targeted advertising, sale, or profiling. The CPA also indirectly impacts AI by regulating automated data processing that affects consumer rights.

JurisdictionColorado
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Colorado Privacy Act (CPA) establishes several key requirements for businesses that process personal data of Colorado residents:

  • Consumer Rights: The CPA grants Colorado consumers specific rights including:
  • Right to access their personal data
  • Right to correct inaccuracies in their personal data
  • Right to delete their personal data
  • Right to data portability
  • Right to opt-out of the sale of personal data, targeted advertising, and certain profiling
  • Data Minimization: Organizations are required to limit data collection to what is adequate, relevant, and reasonably necessary for the specified purposes.

Compliance Challenges

Organizations face several challenges in complying with the CPA:

  • Managing Consumer Rights Requests: Businesses struggle to establish efficient processes for handling consumer data rights requests within required timeframes.

Implementation Best Practices

To effectively implement CPA compliance, organizations should:

  • Implement Data Mapping: Conduct thorough data mapping exercises to identify and categorize all personal data processing activities.
  • Update Privacy Notices: Review and update privacy policies to ensure transparency about data collection, use, and sharing practices.
  • Implement Consent Management: Deploy a consent management platform to handle opt-outs and manage consent for sensitive data processing.

Recent Updates

The Colorado Privacy Act has seen some recent developments:

  • Enforcement Discretion Period: The Colorado Attorney General's office announced a temporary enforcement discretion period from July 1, 2023, to February 29, 2024, to allow businesses additional time to implement compliance measures.

Related Regulations

The CPA shares similarities with other privacy regulations:

Industry Impact

The CPA has significant impacts across various industries:

  • Healthcare and Finance: While largely exempt due to existing regulations, these sectors may need to review their data practices for any non-exempt data processing activities.

Sources

Recent developments

  • — An August 2025 notice reports that on July 29, 2025 the Colorado Department of Law proposed amendments to CPA rules to clarify statutory changes effective October 1, 2025 related to minors.[3] The proposal would raise the protected age from 13 to 18 and require affirmative consent from minors (or parents for children under 13) before processing their data for targeted advertising, sale, profiling, or using engagement-boosting design features.[3] (source)
  • — The proposed minors-focused rule updates signal heightened scrutiny of online services, products, and features directed at young users, aligning CPA practice with emerging “kids’ code” and youth privacy trends.[3] Industry commentary highlights that platforms will need to reassess profiling, personalization, and engagement mechanisms for users under 18 and design consent flows that distinguish parental from minor consent.[3] (source)
  • — A June 2025 industry alert stresses “big changes” to the CPA: enhanced protections for biometric data effective July 1, 2025 and expanded protections for minors effective October 1, 2025.[7] It explains that future minors provisions will cover **any** controller doing business in or intentionally targeting Colorado residents, eliminating prior processing thresholds and broadening compliance obligations.[7] (source)
  • — The article outlines that biometric amendments will require detailed written policies, enhanced security, deletion limits, and restrictions on purchasing biometric identifiers, and will prevent businesses from denying services to consumers who refuse to provide biometrics unless needed to deliver the service.[7] It notes that consent must be refreshed if a consumer has not interacted with the controller in the prior 24 months, increasing ongoing compliance burdens.[7] (source)
  • — A May 2025 update highlights that CPA biometric amendments effective July 1, 2025 will apply to **all** controllers processing any biometric data from Colorado residents, regardless of whether they otherwise meet CPA thresholds.[6] Controllers must provide clear prior notice about biometric collection, purposes, retention periods, and disclosures to processors, and comply with deletion timelines tied to purpose completion, last interaction, or necessity review.[6] (source)
  • — The biometrics amendments require controllers to delete biometric identifiers by the earlier of: when the initial purpose is satisfied, 24 months after last interaction, or within about 45 days after determining storage is no longer necessary, subject to a limited extension.[6] These changes significantly impact industries using facial recognition, voice prints, or other biometric tools by tightening retention, notice, and consent practices.[6] (source)
  • — A 2025 refresh of a CPA resource center notes that, as of July 1, 2024, controllers must honor universal opt-out mechanisms selected by users for targeted advertising and sale of personal data under the CPA.[2] It emphasizes that the Colorado Attorney General and district attorneys hold exclusive enforcement authority, and that businesses face injunctive relief and significant monetary penalties without any private right of action.[2] (source)
  • — The same resource underscores that Colorado residents now have robust rights to access, correct, delete, and port their data, while controllers must obtain consent before processing sensitive data and respond to consumer rights requests within 45 days.[2] Industry guidance from this center reflects that businesses are updating data governance, consent management, and opt-out handling processes to meet CPA and universal opt-out requirements.[2] (source)
  • — Colorado AG finalized updated Colorado Privacy Act rules in December 2024, with most new provisions effective January 30, 2025, and additional rule sections tied to future statutory effective dates for minors’ online activity and biometric data.[5] The rules implement 2024 legislative amendments, detail processes for AG Opinion Letters and Interpretive Guidance, and expand consent and operational requirements for controllers.[5] (source)
  • — The finalized CPA rules implement SB 24-041 (effective October 1, 2025) to require consent before processing data of minors under 18 for targeted advertising, sale of personal data, or certain profiling that leads to legal or similarly significant effects.[5] They also address HB 24-1130 (effective July 1, 2025) by imposing consent and retention obligations and a novel restriction on the sale of biometric identifiers unless the subject is paid and consents, with specified exceptions.[5] (source)

Read the full guide to Colorado Privacy Act (CPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates