Colorado Privacy Act: Practical privacy choices for Colorado customers

Does the law apply to your organisation?

The general scope covers controllers doing business in Colorado or producing or delivering commercial products or services intentionally targeted to its residents, where they meet either of these tests:

• Data volume: control or process personal data of at least 100,000 consumers during a calendar year.
• Sale-related revenue: control or process personal data of at least 25,000 consumers and derive revenue or receive a discount on goods or services from selling personal data.

There is no general minimum-revenue threshold, and nonprofits are not categorically exempt. Consumers generally act in an individual or household context, with relevant exclusions and exemptions.

The Colorado Attorney General’s CPA overview explains the general framework. Additional protections for minors can apply outside the usual volume thresholds, so a smaller service should not end its assessment at visitor numbers.

What makes Colorado different?

Colorado requires covered controllers to recognise qualifying universal opt-out mechanisms for sale and targeted advertising. GPC is recognised, as explained in the Attorney General’s opt-out guidance.

The law also distinguishes between activities people can opt out of and activities requiring consent, including sensitive-data processing. It includes assessment duties for specified higher-risk uses.

Do not treat a California banner as a ready-made Colorado solution. Similar-looking controls can sit on top of different definitions, scope rules and consent requirements.

Five things to get right

1. Explain the actual data uses

List the categories of personal data, purposes, relevant recipients and how customers can exercise their rights. Use the same purpose descriptions across notices and settings.

If you process data for targeted advertising or sell it, make that clear and provide the relevant opt-out. Avoid broad phrases such as “improving your experience” when the activity is advertising across services.

Review the information whenever a new tool or campaign changes what leaves your website.

2. Honour universal opt-out signals

Check that your site recognises the applicable signal and applies it to the relevant sale and targeted-advertising activities.

Test the first visit, repeat visits and any associated profile. Inspect browser requests and server-side destinations. Do not wait for a banner click to apply a recognised signal that must already be honoured.

Keep the outcome understandable. A visitor should not need to guess whether a browser preference has reached your advertising setup.

3. Use consent where the law requires it

Sensitive-data processing requires appropriate consent. Consent is also relevant to certain new uses that are not reasonably necessary for or compatible with the disclosed purpose.

The Colorado Privacy Act Rules describe consent standards and interface considerations. Avoid designs that pressure, confuse or make refusal unnecessarily difficult.

Separate the decision from unrelated terms. A customer agreeing to buy a product should not automatically be treated as consenting to every additional use of sensitive information.

4. Review services used by minors

Colorado strengthened privacy protections for minors through SB24-041. The changes apply to specified online services and activities involving consumers known, or wilfully disregarded, to be under 18.

These requirements can affect targeted advertising, sale and other processing, with consent rules that differ by age and activity. Do not assume the only relevant age is 13.

If your service is likely to involve minors, review the specific requirements before launching advertising or profiling features. Avoid using a generic adult privacy experience as the whole solution.

5. Make rights and assessments operational

Support applicable access, correction, deletion, portability and opt-out rights, including the relevant appeal process. Assign a practical route from request receipt to the systems holding the data.

Assess specified higher-risk processing before relying on it. Record the purpose, likely benefits, possible harms and safeguards. Advertising optimisation should not be the only factor considered.

Keep processor arrangements aligned with these decisions. A contract and a website setting should describe the same intended use.

What this means for your campaigns

A customer may opt out through a browser signal without ever opening your privacy settings. That can change the data available for targeted advertising and audience building.

For example, an ecommerce business might honour GPC in its browser pixel but continue sending an audience file from its customer platform. Review whether the same opted-out purpose continues through that file.

Compare campaign outcomes with appropriate business records and annotate privacy changes. A smaller reachable audience may reflect a working opt-out rather than a broken campaign.

A practical review routine

Review new tools by asking three questions: what personal data will they receive, what will they use it for, and which customer choice controls that use?

Then test the answer. If the tool cannot be configured to honour the applicable choice, change the implementation or reconsider the use before launch.

Keep a simple record of the tool, purpose, consent or opt-out behaviour and test result. This helps your team maintain a consistent setup as campaigns change.

Website checklist

• Check scope: use Colorado’s thresholds, exemptions and additional minors provisions.
• Check purposes: identify sale, targeted advertising, sensitive data and significant profiling.
• Test GPC: verify recognition and the relevant downstream effect.
• Test direct opt-outs: make the choice accessible without unnecessary friction.
• Check consent: review sensitive data and incompatible secondary uses.
• Test rights: include correction, deletion and appeals.
• Check assessments: document relevant higher-risk processing and safeguards.
• Review changes: reassess new tools, audiences and uses involving minors.

FAQ