Colorado Privacy Act
Colorado · Colo. Rev. Stat. Sec. 6-1-1301 et seq. (SB 21-190)
The Colorado Privacy Act gives state residents the right to opt out of having their personal data used for profiling when that profiling drives decisions that produce legal or similarly significant effects, such as decisions about credit, housing, employment, or services. Businesses that engage in higher-risk processing, including certain profiling, must conduct and document a data protection assessment weighing the benefits against the risks. The Colorado Attorney General enforces the law, and since January 1, 2025 may bring actions without first offering a chance to cure.
Technical detail
Colo. Rev. Stat. 6-1-1301 et seq. grants consumers a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects and requires controllers to conduct data protection assessments for processing that presents a heightened risk of harm.
Who is protected: Colorado residents acting in an individual or household context whose personal data is processed by covered controllers.
Who must comply: Controllers that conduct business in Colorado or target Colorado residents and meet the Act's data-volume thresholds.
Key facts
| Jurisdiction | Colorado |
|---|---|
| Level | State |
| Status | In effect |
| Protection strength | Limited protection |
| Effective date | 2023-07-01 |
| Enacted | 2021-07-07 |
| Citation | Colo. Rev. Stat. Sec. 6-1-1301 et seq. (SB 21-190) |
| Enforced by | Colorado Attorney General (and district attorneys) |
| Private right of action | No — agency enforcement only |
| Penalties | Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation (with an aggregate cap for a related series of violations). |
| Topics | consumer data privacy · automated decision-making |
| Last verified | 2026-07-22 |
| Official source | SB21-190 Protect Personal Data Privacy - Colorado General Assembly ↗ |
More AI rules in Colorado
- CO ADMT Act (SB 26-189, 2026) · Enacted (not yet in effect)
- CO SB 17-213 (AV statute) · In effect
- CO Insurance Algorithmic Discrimination Law · In effect
- CO Candidate Deepfake Disclosure Law · In effect
- CO Intimate Digital Depictions Act (SB25-288) · In effect
- Colorado AI Act (repealed) · Repealed / replaced
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for lo · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.