Colorado Privacy Act (CPA)
Colorado Privacy Act
Colorado · Colo. Rev. Stat. Sec. 6-1-1301 et seq. (SB 21-190)
- Status
- In effect
- Took effect
- July 1, 2023
- Applies to
- Controllers that conduct business in Colorado or target Colorado residents and meet the Act's data-volume thresholds.
- Enforced by
- Colorado Attorney General (and district attorneys)
The Colorado Privacy Act gives state residents the right to opt out of having their personal data used for profiling when that profiling drives decisions that produce legal or similarly significant effects, such as decisions about credit, housing, employment, or services. Businesses that engage in higher-risk processing, including certain profiling, must conduct and document a data protection assessment weighing the benefits against the risks. The Colorado Attorney General enforces the law, and since January 1, 2025 may bring actions without first offering a chance to cure.
Who is protected: Colorado residents acting in an individual or household context whose personal data is processed by covered controllers.
Legal detail
Colo. Rev. Stat. 6-1-1301 et seq. grants consumers a right to opt out of profiling in furtherance of decisions producing legal or similarly significant effects and requires controllers to conduct data protection assessments for processing that presents a heightened risk of harm.
Key facts
| Jurisdiction | Colorado |
|---|---|
| Level | State |
| Strength | Limited |
| Enacted | July 7, 2021 |
| Citation | Colo. Rev. Stat. Sec. 6-1-1301 et seq. (SB 21-190) |
| Private right of action | No, agency enforcement only |
| Penalties | Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation (with an aggregate cap for a related series of violations). |
| Topics | consumer data privacy · automated decision-making |
| Bill text | SB21-190 Protect Personal Data Privacy - Colorado General Assembly |
More AI rules in Colorado
- CO SB 17-213 (AV statute) · In effect
- CO Insurance Algorithmic Discrimination Law · In effect
- CO Candidate Deepfake Disclosure Law · In effect
- CO Intimate Digital Depictions Act (SB25-288) · In effect
- Colorado AI Act (repealed) · Repealed / replaced
- SB 26-189 (Colorado ADMT Law) · Enacted (not yet in effect)
Related consumer data privacy rules elsewhere
- Vermont Data Broker Law (H.211) · Enacted (not yet in effect)
- Chatrie v. United States (Fourth Amendment protection for location… · Blocked / in litigation
- House Bill 2512 — Banning surveillance pricing by rideshare companies · Proposed / pending
- Kids Internet and Digital Safety Act (KIDS Act) (H.R. 7757) · Proposed / pending
- Maine LD 61 (employer surveillance disclosure & prohibition) · In effect
- Washington SHB 1672 (employee monitoring notice, ADS restrictions, emotion AI ban) · In effect
See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.