Meet Colorado Privacy Act (CPA) duties with less manual work
The Colorado Privacy Act (CPA) is a Colorado state law, codified at C.R.S. 6-1-1301 et seq., that governs how businesses collect and use the personal data of Colorado residents. It gives consumers rights to access, correct, delete and port their data and to opt out of targeted advertising, sale and profiling. It also places duties of transparency, data minimisation, care and consent on controllers, and contract duties on processors.
Is CPA right for your organisation?
The CPA applies to controllers that conduct business in Colorado or deliver products or services intentionally targeted to Colorado residents, and that control or process personal data of 100,000 or more consumers in a calendar year, or of 25,000 or more consumers while deriving revenue or a discount from selling personal data. Processors acting for those controllers have contractual and security duties. Amendments mean biometric data rules can apply below these thresholds, and extra protections apply to minors' data from October 2025.
It is a legal or regulatory requirement for organisations in scope.
- Citation
- C.R.S. 6-1-1301 et seq. (enacted by Senate Bill 21-190)
- In force since
- 1 July 2023
- Implementing rules
- Colorado Privacy Act Rules, 4 CCR 904-3
- Applies to
- Controllers processing data of 100,000+ Colorado consumers a year, or 25,000+ while earning revenue from selling personal data
- Enforced by
- Colorado Attorney General and district attorneys; no private right of action
- Universal opt-out
- Controllers must honour recognised universal opt-out mechanisms, such as Global Privacy Control, since 1 July 2024
- Penalties
- Violations are deceptive trade practices under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation
- Type
- Law (mandatory)
- Region
- Colorado, US
- In OneClickComply
- Supported today
OneClickComply makes it simple
The Colorado Privacy Act is mapped in OneClickComply's control library and is available on request, so your CPA programme can be built on the same controls you use for frameworks such as ISO 27001 or SOC 2. OneClickComply generates privacy policies and processor contract requirements from your real environment, tracks data protection assessments in the risk register, and monitors the security controls behind the CPA duty of care with automated evidence collection.
Requirements covered
Part 13 of Article 1, Title 6 of the Colorado Revised Statutes (sections 6-1-1301 to 6-1-1314), with consumer rights in section 6-1-1306, controller duties in section 6-1-1308 and data protection assessments in section 6-1-1309, supported by the Attorney General's rules at 4 CCR 904-3.
Manual CPA vs. OneClickComply
- Tracking which state privacy laws apply as thresholds and amendments change
- Rewriting privacy notices by hand to meet each state's disclosure rules
- Chasing processors for contract terms and proof of security measures
- Keeping data protection assessments current in scattered documents
- Gathering security evidence manually whenever a regulator or customer asks
- One control set mapped across the CPA and other frameworks you use
- Policies generated from your real environment and kept up to date
- Vendor risk workflows that record processor terms and reviews
- Assessments held in a single risk register with clear owners
- Evidence collected continuously, ready when someone asks for it
Everything you need for CPA
AutoComplete privacy policies that cover CPA privacy notice content
Processor contract requirements tracked through vendor risk management
Data protection assessments recorded and reviewed in the risk register
Continuous monitoring of the security controls behind the CPA duty of care
Automated evidence collection from 13,000+ integrations
CPA controls mapped to ISO 27001, SOC 2 and other privacy laws you follow
Three steps to CPA compliance
Connect & scan
Connect your cloud, identity and SaaS tools. OneClickComply checks them against CPA and shows you exactly where you stand.
Fix & generate
OneClickFix remediates technical gaps in one click, and AutoComplete generates CPA-aligned policies from your real environment.
Monitor & evidence
Continuous monitoring keeps you compliant, and our in-house audit team is on hand when you need expert guidance.
Colorado Privacy Act requirements
The main operative sections of the Colorado Privacy Act, with the controller, processor and consumer rights provisions in sections 6-1-1305, 6-1-1306 and 6-1-1308 broken out by subsection.
| Reference | Requirement |
|---|---|
| 6-1-1303 | Definitions |
| 6-1-1304 | Applicability and exemptions |
| 6-1-1305(1) | Processor adheres to controller instructions and assists the controller |
| 6-1-1305(2) | Processor assistance with consumer requests, security, breach notification and assessments |
| 6-1-1305(3) | Processor confidentiality duties and use of subcontractors |
| 6-1-1305(4) | Appropriate technical and organisational security measures |
| 6-1-1305(5) | Binding controller and processor contract terms |
| 6-1-1306(1)(a) | Right to opt out of targeted advertising, sale and profiling |
| 6-1-1306(1)(a)(II) | Opt-out through an authorised agent |
| 6-1-1306(1)(a)(IV) | Universal opt-out mechanism |
| 6-1-1306(1)(b) | Right of access |
| 6-1-1306(1)(c) | Right to correction |
| 6-1-1306(1)(d) | Right to deletion |
| 6-1-1306(1)(e) | Right to data portability |
| 6-1-1306(2) | Responding to consumer requests and authentication |
| 6-1-1306(3) | Internal appeals process |
| 6-1-1307 | Processing de-identified data |
| 6-1-1308(1) | Duty of transparency: privacy notice and opt-out disclosures |
| 6-1-1308(2) | Duty of purpose specification |
| 6-1-1308(3) | Duty of data minimisation |
Always check the official CPA text for the exact wording.
CPA FAQs
What is the Colorado Privacy Act?
The Colorado Privacy Act (CPA) is a comprehensive consumer privacy law codified at C.R.S. 6-1-1301 et seq. It took effect on 1 July 2023. It gives Colorado residents rights over their personal data, including access, correction, deletion, portability and opting out of targeted advertising, sale and certain profiling, and it sets duties for businesses that act as controllers or processors of that data.
Who must comply with the Colorado Privacy Act?
Controllers that conduct business in Colorado or target products or services at Colorado residents must comply if, in a calendar year, they control or process personal data of 100,000 or more consumers, or of 25,000 or more consumers while deriving revenue or a discount from selling personal data. Processors working for those controllers also have duties. Biometric data provisions added in 2024 can apply to organisations below these thresholds.
What are the penalties for violating the Colorado Privacy Act?
A CPA violation is treated as a deceptive trade practice under the Colorado Consumer Protection Act, which allows civil penalties of up to $20,000 per violation. The Colorado Attorney General and district attorneys enforce the law, and there is no private right of action for consumers. The 60-day cure period that let businesses fix violations before enforcement ended on 1 January 2025.
What is a universal opt-out mechanism under the CPA?
A universal opt-out mechanism is a browser or device signal, such as Global Privacy Control, that tells websites a consumer opts out of targeted advertising and sale of personal data. Since 1 July 2024, controllers covered by the CPA must honour the mechanisms recognised by the Colorado Attorney General, treating the signal as a valid opt-out request without the consumer having to contact each business.
Does the Colorado Privacy Act require data protection assessments?
Yes. Section 6-1-1309 requires controllers to conduct and document a data protection assessment before processing that presents a heightened risk of harm to consumers. This includes targeted advertising, selling personal data, processing sensitive data and certain profiling. Assessments must weigh benefits against risks and be made available to the Attorney General on request.
How does the Colorado Privacy Act compare with GDPR?
The CPA borrows several GDPR concepts, including controllers and processors, data minimisation, purpose specification, opt-in consent for sensitive data and data protection assessments. It differs because it applies only above volume thresholds, relies mainly on opt-out rights for advertising and sale rather than a lawful basis for all processing, and has no private right of action. A GDPR programme is a useful starting point but does not cover every CPA requirement.
How do I comply with the Colorado Privacy Act?
Start by confirming whether you meet the thresholds and mapping the personal data you hold. Then publish a compliant privacy notice, set up processes to handle consumer requests and appeals within 45 days, honour universal opt-out signals, obtain consent before processing sensitive data, put written contracts in place with processors, apply reasonable security measures and document data protection assessments for higher-risk processing.
Does OneClickComply support the Colorado Privacy Act?
The Colorado Privacy Act is mapped in OneClickComply's control library and is available on request. Its controls link to the same evidence, policies, vendor reviews and risk register entries used for frameworks such as ISO 27001 and SOC 2, so work done once counts towards CPA too. OneClickComply does not certify CPA compliance, but its in-house audit team can advise on your approach.
Further reading on CPA
All articlesRelated standards
All standards- California Consumer Privacy Act (CCPA)Law · US
- Nevada Consumer Health Data and Data Security Law (NRS 603A)Law · US
- Oregon Consumer Information Protection Act (ORS 646A.600 to 646A.628)Law · US
- Texas Data Privacy and Security ActLaw · US
- NAIC Insurance Data Security Model Law (MDL-668)Law · US
- Tennessee Information Protection ActLaw · US
- Oregon Consumer Privacy ActLaw · US
- Virginia Consumer Data Protection ActLaw · US
Get CPA ready, not stressed
Automate controls, gather evidence continuously and stay audit-ready, all on one platform.