Colorado Privacy Act: GPC, minors’ data and what your website needs to do

Does the CPA apply to your organisation?

The general rules cover controllers that do business in Colorado or intentionally target its residents and that:

• Volume: control or process personal data of 100,000 or more Colorado consumers in a calendar year; or
• Data sales: earn revenue or a discount from selling personal data and control or process data of 25,000 or more consumers.

There is no revenue threshold, and the Attorney General’s guidance confirms that nonprofits are covered, unlike in Virginia and Utah. Exemptions include GLBA financial institutions, air carriers, HIPAA-governed data and employee data.

The minors’ and biometric rules reach further: they also apply to controllers below these thresholds, as the table below shows.

What has changed since the law took effect?

How must you handle GPC and other opt-out signals?

If you sell personal data or use it for targeted advertising, the CPA requires you to accept opt-outs sent through a recognised universal opt-out mechanism. The Attorney General’s list currently names one: Global Privacy Control (GPC).

Under the CPA Rules, GPC is a valid opt-out of targeted advertising and sale for that browser or device and, if you know the person, for that consumer. It stays in force until they consent; a later visit without the signal is not consent, and you cannot require a login.

Direct opt-outs still matter: show the opt-out method in your privacy notice and in an accessible place outside it, such as a footer link. The notice also has to explain how you process opt-out signals.

Passiro handles GPC on every plan and treats the signal as an opt-out; the GPC guide explains how to test what your tags and server-side flows do with it.

What applies to users under 18?

Since 1 October 2025, SB24-041 applies when you offer an online service to someone you know, or wilfully disregard, is under 18. You must use reasonable care to avoid a heightened risk of harm to minors.

Without consent from the minor, or from a parent or guardian if the minor is under 13, you may not:

• process a minor’s data for targeted advertising, sale or significant profiling;
• use it beyond the purposes disclosed at collection, or keep it longer than needed;
• use design features to significantly increase, sustain or extend a minor’s use;
• collect precise geolocation, unless it is necessary for the service, kept only as long as needed and signalled to the minor throughout.

The law does not require age verification. Where a feature creates a heightened risk of harm, document an assessment and a plan to reduce the risk, and do not use consent requests designed to subvert a minor’s choice.

When else do you need consent?

You need consent before processing or selling sensitive data: data revealing racial or ethnic origin, religious beliefs, a health condition or diagnosis, sex life or sexual orientation, or citizenship status; genetic, biometric, biological or neural data used to identify someone; a known child’s data; and precise geolocation within 1,850 feet (about 560 metres).

Consent is also needed for secondary uses that are not reasonably necessary for or compatible with the disclosed purposes, and for targeted advertising or sale after an opt-out. Accepting broad terms, or agreement obtained through dark patterns, does not count.

The CPA Rules require you to refresh sensitive-data consent after 24 months without interaction, unless the consumer can change choices at any time in a settings page. Biometric identifiers also need a public retention policy and notice of purpose and retention before collection.

How do requests and appeals work?

Consumers can opt out, access, correct and delete their data, and get a portable copy up to twice a calendar year. For an online-only business, the Attorney General says an email address is enough as a request method.

Respond within 45 days (extendable by 45). If you decline, say why and how to appeal. The appeal must be conspicuous and as easy as the request; answer it in writing within 45 days (extendable by 60) and tell the consumer they can contact the Attorney General.

Website checklist

• GPC on: visit with GPC enabled, then again without it; advertising and sale tags should stay off both times, with no login.
• Known customers: an opted-out, signed-in customer should be missing from the next audience or customer-list upload.
• Direct opt-out: use the footer opt-out link as a test user; it should stop the same activities as GPC.
• Consent: test forms and location prompts; sensitive data, including precise location, should not flow before consent is recorded.
• Minors: for known under-18 users, advertising, sale and precise location should stay off without consent.
• Request and appeal: decline a test request and appeal it; the written answer should mention the Attorney General.

FAQ