Colorado Privacy Act: cookie rules for Colorado visitors

What is the Colorado Privacy Act?

The Colorado Privacy Act (CPA) was enacted by Senate Bill 21-190, signed on 7 July 2021, and took effect on 1 July 2023. It is part of Colorado's Consumer Protection Act, and unlike Virginia's law it gave the Attorney General the power to adopt rules. The CPA Rules (4 CCR 904-3), filed on 15 March 2023, are the most detailed state privacy regulations after California's: they set standards for privacy notices, consent, dark patterns and universal opt-out mechanisms.

The Act has been amended several times since. Senate Bill 24-041 added protections for minors from 1 October 2025, House Bill 24-1058 added biological and neural data to sensitive data, and Senate Bill 25-276, signed on 23 May 2025, added precise geolocation data to sensitive data and bars selling sensitive data without consent. For how Colorado compares with the other states, see US state privacy laws.

Who does the Colorado Privacy Act apply to?

The Act applies to entities that conduct business in Colorado or deliver commercial products or services targeted to Colorado residents and that, in a calendar year, either:

• control or process the personal data of 100,000 or more Colorado consumers, or
• derive revenue or receive a discount on goods or services from the sale of personal data and process the personal data of 25,000 or more consumers.

The Attorney General confirms that 100,000 means Colorado residents, not visitors from all states. There is no revenue threshold, and non-profits are covered, which sets Colorado apart from Virginia and Texas. Financial institutions subject to the Gramm-Leach-Bliley Act are exempt, as is data covered by HIPAA and the Fair Credit Reporting Act. Employee and job applicant data are outside the Act. The minors' protections added by Senate Bill 24-041 apply to any controller doing business in Colorado, regardless of volume.

What does the Act require for cookies and trackers?

The CPA regulates the purposes of processing rather than the cookie. Cookie identifiers, IP addresses and device identifiers that can reasonably be linked to a person are personal data. The obligations that matter for a website are:

• Opt-out of targeted advertising and sale. Targeted advertising means ads selected from personal data obtained from a consumer's activity over time across non-affiliated websites or apps, which covers retargeting pixels and ad network cookies. Sale means an exchange for money or other valuable consideration, so passing data to an ad tech partner in exchange for a service can count. Consumers can also opt out of profiling in furtherance of decisions with legal or similarly significant effects.
• A clear and conspicuous opt-out method, available in the privacy notice and in a readily accessible location outside it.
• Consent for sensitive data: data revealing racial or ethnic origin, religious beliefs, health conditions or diagnoses, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, biological and neural data, the personal data of a known child under 13, and, since 2025, precise geolocation data.
• Consent for minors. Since 1 October 2025, a controller that knows or willfully disregards that a consumer is a minor must obtain consent (from a parent for a child under 13) before processing that person's data for targeted advertising, sale or significant profiling.

Consent under the CPA must be a clear, affirmative act that is freely given, specific, informed and unambiguous. The Attorney General's guidance spells out what does not count: accepting broad terms of service, hovering over, pausing on or otherwise interacting with content, and agreement obtained through deceptive design. The Rules add design standards for consent requests, so a choice that nudges toward yes is not valid consent.

Analytics for the site's own use is neither targeted advertising nor a sale, and needs only a description in the privacy notice.

Must I honor Global Privacy Control in Colorado?

Yes. Section 6-1-1306(1)(a)(IV) requires controllers, since 1 July 2024, to let consumers opt out of the sale of personal data and targeted advertising through a universal opt-out mechanism. Rule 5.07 required the Attorney General to publish a list of recognized mechanisms; after taking applications from October to November 2023 and public comment until December 2023, the Department of Law recognized Global Privacy Control, which remains the only mechanism on the list. The privacy notice must also explain how opt-out requests sent through universal mechanisms are processed (Rule 6.03).

In practice, when a browser sends the GPC signal, a covered website must stop advertising tags and data sales for that browser, and for the account if the visitor is signed in. On 9 September 2025 Colorado, California and Connecticut announced a joint investigative sweep of businesses that ignore GPC. The Global Privacy Control guide explains how to detect and apply the signal.

What must a compliant notice do for Colorado visitors?

• A privacy notice with the categories of data, purposes, third parties, rights and appeal process, a clear statement of any sale or targeted advertising, and how universal opt-out signals are handled.
• A visible link or control to opt out of targeted advertising and sale, outside the privacy notice.
• Detection of Global Privacy Control, applied without asking the visitor to confirm.
• Opt-in consent, free of dark patterns, before sensitive data or known minors' data is used for those purposes.
• Answers to rights requests within 45 days, extendable by another 45 days.

Enforcement and penalties

The Attorney General and the district attorneys have exclusive enforcement power; there is no private right of action. Until 1 January 2025, they had to send a notice and allow 60 days to cure a violation that could be remedied. That cure period has ended for the core Act, although a cure notice still applies to the minors' provisions for a transitional period. A violation is a deceptive trade practice, so penalties come from section 6-1-112 of the Consumer Protection Act: up to $20,000 per violation, or $50,000 where the violation is committed against an elderly person, with each consumer or transaction counted as a separate violation.

On 12 July 2023 the Attorney General announced the launch of enforcement and began mailing letters to businesses about their obligations. We found no announced fine or settlement under the CPA alone as of October 2026; the visible activity has been the letters, the universal opt-out list and the joint GPC sweep of September 2025.

How Cookiequiet handles Colorado

Cookiequiet honors Global Privacy Control as an opt-out on every plan, which is what Colorado asks of covered businesses. With geo-targeting, included free, visitors from Colorado can see an opt-out notice with a "Do not sell or share my personal information" link while EU and UK visitors get the opt-in banner, and marketing tags held by the category system stop when a visitor opts out. You can check which advertising tags your site loads with the free cookie scanner. Policy templates are written for the CCPA/CPRA, so review the Colorado notice items with your advisor.