Laws

Colorado Privacy Act (CPA): your rights, Global Privacy Control and how to complain

Quick answer

If you live in Colorado, the Colorado Privacy Act lets you see the personal data a covered company holds about you, correct it or have it deleted, and opt out of targeted ads, sales or certain profiling. The quickest opt-out is Global Privacy Control: since July 1, 2024 covered companies must honor it. For deletion and the other rights, send a request through the company's privacy notice; it has 45 days to answer, and if it refuses you can appeal and then complain to the Colorado Attorney General.

“The CPA grants Colorado Consumers new rights with respect to their personal data, including the right to access, delete, and correct their personal data”

All privacy laws
Applies in
Colorado
In force since
Companies must answer within
Without undue delay and within 45 days of receiving your request. The company can extend by 45 more days if it tells you why within the first 45 days (C.R.S. § 6-1-1306(2)). Appeals get a decision within 45 days, which the company can extend by 60 more days with notice (§ 6-1-1306(3)).
Regulator
Colorado Attorney General (Colorado Department of Law)
Last updated

By Anthon Wansland

Head of Product & Co-Founder

Reviewed by Ludwig Sandgren

Head of Legal

Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.

Sources checked: coag.gov

Last verified against the official page:

How we research this Report an error

Colorado residents acting as individuals or households, not as employees or job applicants. The law applies to companies, and according to the Attorney General also nonprofits, that do business in Colorado or target Coloradans and either handle the personal data of 100,000 or more Coloradans a year, or earn revenue or get a discount from selling personal data and handle data on 25,000 or more. Financial institutions covered by the Gramm-Leach-Bliley Act, air carriers and national securities associations are excluded, and so is data covered by HIPAA and activity covered by the Fair Credit Reporting Act.

Your rights

  • Opt out

    Stop a company using your data for targeted advertising, selling it, or profiling you for decisions with legal or similarly significant effects. Someone else can opt out for you, including a browser setting, browser extension or global device setting (C.R.S. § 6-1-1306(1)(a)).

  • Access

    Ask a company whether it processes your personal data, and see that data (C.R.S. § 6-1-1306(1)(b)).

  • Correct

    Have inaccurate personal data fixed (C.R.S. § 6-1-1306(1)(c)).

  • Delete

    Have a company delete personal data concerning you (C.R.S. § 6-1-1306(1)(d)).

  • Get a portable copy

    Get your data in a portable, readily usable format, up to twice a calendar year (C.R.S. § 6-1-1306(1)(e)).

  • Universal opt-out

    Since July 1, 2024 companies must honor a universal opt-out signal you choose, as long as it meets the Attorney General's specifications. Global Privacy Control is currently the only one on the list (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

  • Appeal

    Appeal a refusal through an internal process that's as easy to use as the request process. The company must tell you that you can contact the Attorney General (C.R.S. § 6-1-1306(3)).

  • Consent for sensitive data

    A company needs your affirmative consent before it processes sensitive data about you (C.R.S. § 6-1-1308).

General information, not legal advice.

How to use it

  1. 1

    Turn on Global Privacy Control

    For opting out of targeted ads and sales, you don't have to write to anyone. Use a browser or extension that sends Global Privacy Control (GPC). Since July 1, 2024 covered companies must treat it as your opt-out, and it's the only signal on the Attorney General's recognized list.

  2. 2

    Find the request method in the privacy notice

    For access, correction, deletion or a copy, use the request method in the company's privacy notice. Companies must offer methods that fit how you normally deal with them, and they can't make you create a new account.

  3. 3

    Say which rights you want to use

    Name them: access, correction, deletion, a copy or an opt-out. A line like "Under the Colorado Privacy Act, please delete the personal data you hold about me" is enough. Your first request in any 12-month period is free.

  4. 4

    Wait up to 45 days

    The company must act, or explain why it won't, within 45 days. It can extend by 45 more days if it tells you why inside the first 45.

  5. 5

    Appeal if the company refuses

    Use the company's internal appeal. It must decide within 45 days, or within 105 days if it tells you it needs the 60-day extension.

  6. 6

    Complain to the Colorado Attorney General

    File a complaint with the Colorado Department of Law on its complaint page. The Attorney General and district attorneys enforce the law: you can't sue a company under it yourself.

No answer in time? Complain to Colorado Attorney General (Colorado Department of Law) .

Who has to follow the Colorado Privacy Act

The law covers companies that do business in Colorado or target Coloradans and handle the personal data of 100,000 or more Coloradans in a year. A company with data on 25,000 or more is covered too if it earns money, or gets a discount, from selling personal data.

One difference from most states: according to the Attorney General, nonprofits that meet those thresholds are covered. Virginia exempts them, and so do Iowa and Indiana.

Global Privacy Control does the opt-outs for you

Since July 1, 2024, a company that uses your data for targeted ads or sells it must accept an opt-out sent by a universal signal you've switched on. The Attorney General keeps the list of signals that qualify, and right now Global Privacy Control is the only one.

GPC only covers opt-outs. It won't delete anything, so for deletion you still send a request.

How far deletion goes

The CPA's wording is broad: you can delete "personal data concerning" you, not only data you handed over. That's wider than Utah or Iowa, where deletion is limited to data you provided.

Why a company can say no

Some companies and some data are outside the law. Financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) are excluded, along with air carriers. HIPAA health data and activity covered by the Fair Credit Reporting Act (credit reports) are excluded too.

If a company cites one of these, that's the likely reason for the refusal. Ask which one. You can appeal and, if you still think it's wrong, complain to the Attorney General. Our guide on what to do when a company won't delete your data has more on next steps.

About the section numbers

The section numbers here come from Senate Bill 21-190 as enacted, which the Attorney General publishes. Colorado has amended the law since then, so check the current Colorado Revised Statutes if you need the exact wording today.

Where Serus fits

GPC handles opt-outs, but deletion still means writing to each company, and you need to know which ones hold your data. Serus finds the data brokers that operate where you live, sends the deletion requests and checks whether your data reappears. The steps above cost nothing if you'd rather do them yourself.

Data brokers that list people in United States

Each guide shows how to opt out of that site, step by step.

All data broker guides
Serus

Let Serus send the requests for you

Serus finds the data brokers that list you where you live and removes you from them.

Run a free scan

Related

Frequently asked

Do Colorado businesses have to honor Global Privacy Control?

Yes. Since July 1, 2024 covered businesses must honor GPC as an opt-out of sales and targeted advertising. It's the only mechanism on the Attorney General's recognized list.

How long does a company have to respond?

45 days, and it can extend by 45 more days if it tells you why within the first 45.

Can a company charge me?

Your first request in a 12-month period is free. The company may charge for later requests in that period.

Can I sue under the Colorado Privacy Act?

No. Only the Attorney General and district attorneys can enforce it.

Does the Colorado Privacy Act apply to nonprofits?

Yes. The Attorney General says it applies to entities, including nonprofits, that meet the thresholds. Many other states exempt nonprofits.

Can my employer or landlord use the CPA to get my data?

No. According to the Attorney General, the access right is for a Colorado resident's own data and gives third parties no right to request it.

Sources

Something wrong or out of date? Tell us and we'll re-check it.

Cookie preferences

Choose which categories we may use. Full details for every cookie are in our Cookie Policy.

Strictly necessary

Authentication, session management, security and fraud prevention, and saving your consent choice. Always active. The site cannot function without them.

Functional

Remember preferences such as language and settings that improve your experience.

Analytics

Help us understand how the site is used, like pages visited, interactions, and performance, so we can improve it.

Marketing & advertising

Measure our marketing and deliver more relevant ads through partners such as Google, Meta, TikTok, X, and Reddit. Used only with your consent.

Your choice is saved for 12 months and applies across serus.ai, including the app. You can change it anytime from the cookie widget or the "Cookie settings" link in the footer. Withdrawing consent does not affect processing that happened before withdrawal.