# Colorado Privacy Act: cookie rules for Colorado visitors > Colorado does not require consent before cookies, but it was the first state to make businesses honor a universal opt-out signal. Since 1 July 2024 a covered business must treat Global Privacy Control, the only mechanism on the Attorney General's recognized list, as a request to opt out of targeted advertising and the sale of personal data. Sensitive data and, since 1 October 2025, the data of known minors used for targeted advertising need opt-in consent. The Attorney General and district attorneys enforce, the cure period ended on 1 January 2025, and penalties reach $20,000 per violation. Source: https://cookiequiet.com/laws/colorado Published: 2026-10-21 Publisher: Cookiequiet ## Quick facts - **Applies to:** Businesses and non-profits that operate in Colorado or target its residents and, in a calendar year, process the personal data of 100,000 or more Colorado consumers, or earn revenue or discounts from selling the personal data of 25,000 or more; minors' protections apply regardless of volume - **Consent model:** Opt-out of targeted advertising, sale (for money or other valuable consideration) and profiling with legal or similarly significant effects; opt-in for sensitive data and for targeted advertising, sale or profiling involving known minors - **Universal opt-out:** Required since 1 July 2024; Global Privacy Control is the only mechanism on the Attorney General's recognized list - **Authority:** Colorado Attorney General and district attorneys (no private right of action) - **Maximum penalty:** Up to $20,000 per violation under the Colorado Consumer Protection Act (up to $50,000 where the victim is elderly); each consumer or transaction can be a separate violation - **In force since:** 1 July 2023; universal opt-out 1 July 2024; cure period ended 1 January 2025; minors' amendments 1 October 2025 ## What is the Colorado Privacy Act? The Colorado Privacy Act (CPA) was enacted by Senate Bill 21-190, signed on 7 July 2021, and took effect on 1 July 2023. It is part of Colorado's Consumer Protection Act, and unlike Virginia's law it gave the Attorney General the power to adopt rules. The CPA Rules (4 CCR 904-3), filed on 15 March 2023, are the most detailed state privacy regulations after California's: they set standards for privacy notices, consent, dark patterns and universal opt-out mechanisms. The Act has been amended several times since. Senate Bill 24-041 added protections for minors from 1 October 2025, House Bill 24-1058 added biological and neural data to sensitive data, and Senate Bill 25-276, signed on 23 May 2025, added precise geolocation data to sensitive data and bars selling sensitive data without consent. For how Colorado compares with the other states, see [US state privacy laws](/laws/us-state-privacy-laws). ## Who does the Colorado Privacy Act apply to? The Act applies to entities that conduct business in Colorado or deliver commercial products or services targeted to Colorado residents and that, in a calendar year, either: - control or process the personal data of 100,000 or more Colorado consumers, or - derive revenue or receive a discount on goods or services from the sale of personal data and process the personal data of 25,000 or more consumers. The Attorney General confirms that 100,000 means Colorado residents, not visitors from all states. There is no revenue threshold, and non-profits are covered, which sets Colorado apart from Virginia and Texas. Financial institutions subject to the Gramm-Leach-Bliley Act are exempt, as is data covered by HIPAA and the Fair Credit Reporting Act. Employee and job applicant data are outside the Act. The minors' protections added by Senate Bill 24-041 apply to any controller doing business in Colorado, regardless of volume. ## What does the Act require for cookies and trackers? The CPA regulates the purposes of processing rather than the cookie. Cookie identifiers, IP addresses and device identifiers that can reasonably be linked to a person are personal data. The obligations that matter for a website are: - **Opt-out of targeted advertising and sale.** Targeted advertising means ads selected from personal data obtained from a consumer's activity over time across non-affiliated websites or apps, which covers retargeting pixels and ad network cookies. Sale means an exchange for money or other valuable consideration, so passing data to an ad tech partner in exchange for a service can count. Consumers can also opt out of profiling in furtherance of decisions with legal or similarly significant effects. - **A clear and conspicuous opt-out method**, available in the privacy notice and in a readily accessible location outside it. - **Consent for sensitive data**: data revealing racial or ethnic origin, religious beliefs, health conditions or diagnoses, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data, biological and neural data, the personal data of a known child under 13, and, since 2025, precise geolocation data. - **Consent for minors.** Since 1 October 2025, a controller that knows or willfully disregards that a consumer is a minor must obtain consent (from a parent for a child under 13) before processing that person's data for targeted advertising, sale or significant profiling. Consent under the CPA must be a clear, affirmative act that is freely given, specific, informed and unambiguous. The Attorney General's guidance spells out what does not count: accepting broad terms of service, hovering over, pausing on or otherwise interacting with content, and agreement obtained through deceptive design. The Rules add design standards for consent requests, so a choice that nudges toward yes is not valid consent. Analytics for the site's own use is neither targeted advertising nor a sale, and needs only a description in the privacy notice. ## Must I honor Global Privacy Control in Colorado? Yes. Section 6-1-1306(1)(a)(IV) requires controllers, since 1 July 2024, to let consumers opt out of the sale of personal data and targeted advertising through a universal opt-out mechanism. Rule 5.07 required the Attorney General to publish a list of recognized mechanisms; after taking applications from October to November 2023 and public comment until December 2023, the Department of Law recognized Global Privacy Control, which remains the only mechanism on the list. The privacy notice must also explain how opt-out requests sent through universal mechanisms are processed (Rule 6.03). In practice, when a browser sends the GPC signal, a covered website must stop advertising tags and data sales for that browser, and for the account if the visitor is signed in. On 9 September 2025 Colorado, California and Connecticut announced a joint investigative sweep of businesses that ignore GPC. The [Global Privacy Control guide](/guides/global-privacy-control) explains how to detect and apply the signal. ## What must a compliant notice do for Colorado visitors? - A privacy notice with the categories of data, purposes, third parties, rights and appeal process, a clear statement of any sale or targeted advertising, and how universal opt-out signals are handled. - A visible link or control to opt out of targeted advertising and sale, outside the privacy notice. - Detection of Global Privacy Control, applied without asking the visitor to confirm. - Opt-in consent, free of dark patterns, before sensitive data or known minors' data is used for those purposes. - Answers to rights requests within 45 days, extendable by another 45 days. ## Enforcement and penalties The Attorney General and the district attorneys have exclusive enforcement power; there is no private right of action. Until 1 January 2025, they had to send a notice and allow 60 days to cure a violation that could be remedied. That cure period has ended for the core Act, although a cure notice still applies to the minors' provisions for a transitional period. A violation is a deceptive trade practice, so penalties come from section 6-1-112 of the Consumer Protection Act: up to $20,000 per violation, or $50,000 where the violation is committed against an elderly person, with each consumer or transaction counted as a separate violation. On 12 July 2023 the Attorney General announced the launch of enforcement and began mailing letters to businesses about their obligations. We found no announced fine or settlement under the CPA alone as of October 2026; the visible activity has been the letters, the universal opt-out list and the joint GPC sweep of September 2025. ## How Cookiequiet handles Colorado Cookiequiet honors Global Privacy Control as an opt-out on every plan, which is what Colorado asks of covered businesses. With geo-targeting, included free, visitors from Colorado can see an opt-out notice with a "Do not sell or share my personal information" link while EU and UK visitors get the opt-in banner, and marketing tags held by the category system stop when a visitor opts out. You can check which advertising tags your site loads with the free [cookie scanner](/tools/cookie-scanner). Policy templates are written for the CCPA/CPRA, so review the Colorado notice items with your advisor. ## Questions ### Does Colorado require a cookie consent banner? No. The Colorado Privacy Act works on opt-out for targeted advertising and sales, with opt-in only for sensitive data and known minors' data. You need a privacy notice, a visible opt-out method and Global Privacy Control handling, not an EU-style banner. ### Is Global Privacy Control mandatory in Colorado? Yes, since 1 July 2024. Covered businesses must treat GPC as a request to opt out of targeted advertising and the sale of personal data. It is the only universal opt-out mechanism on the Colorado Attorney General's recognized list. ### Does the Colorado Privacy Act apply to non-profits? Yes. Unlike Virginia and Texas, Colorado does not exempt non-profit organizations. A non-profit that processes the data of 100,000 or more Colorado residents a year, or sells the data of 25,000 or more, must comply. ### What are the fines under the Colorado Privacy Act? Violations are deceptive trade practices under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation, or $50,000 if the victim is elderly. Each consumer or transaction can count separately. The 60-day cure period for the core Act ended on 1 January 2025. ## Sources - [Colorado Attorney General, Colorado Privacy Act (overview, FAQ, enforcement)](https://coag.gov/resources/colorado-privacy-act/) - [Colorado Attorney General, Universal Opt-Out and the Colorado Privacy Act (recognized mechanisms list)](https://coag.gov/opt-out/) - [Colorado General Assembly, SB24-041 Privacy Protections for Children's Online Data](https://leg.colorado.gov/bills/sb24-041) - [Colorado General Assembly, SB25-276 (precise geolocation and sale of sensitive data)](https://leg.colorado.gov/bills/sb25-276) - [Colorado Revised Statutes, section 6-1-112, Civil penalties (republished text)](https://colorado.public.law/statutes/crs_6-1-112) - [Connecticut Attorney General, Connecticut, California and Colorado announce joint investigative privacy sweep (9 September 2025)](https://portal.ct.gov/ag/press-releases/2025-press-releases/connecticut-california-and-colorado-announce-joint-investigative-privacy-sweep)