Regulations
by Glyph
Data, privacy and AI rules
Search laws like GDPR, EU AI Act, CCPA and 187 more
Due in 60 days
12
Regulations
190
12
due in 60 days
·
190
regulations
Home
/
Jurisdictions
/
Colorado
Jurisdiction
Colorado privacy and AI laws
Part of
US States
.
Regulations
Add to calendar
Apple Calendar or Outlook
Google Calendar
Download .ics
Enacted
Colorado AI Act
Colorado's 2024 high-risk AI law (risk-management programs, impact assessments) never took effect: it was delayed to June 30, 2026 and then repealed and reenacted by SB 26-189, signed May 14, 2026, as a narrower automated decision-making technology (ADMT) law. From January 1, 2027, developers must give deployers technical documentation (intended uses, training data categories, limitations) and deployers must notify consumers at the point of interaction, explain ADMT's role within 30 days after an adverse outcome, and offer data correction and meaningful human review. Impact-assessment and risk-management-program mandates were dropped; 3-year record retention remains.
Next:
Jan 1, 2027
ADMT obligations apply · in 2 months
Amended
Colorado Privacy Act (CPA)
Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.
In effect since Jul 1, 2023
Upcoming deadlines
Takes effect
Jan 1, 2027 ·
in 2 months
Colorado AI Act
ADMT obligations apply
Developer documentation, consumer notices, post-adverse-outcome disclosure, correction and human-review rights take effect.
Colorado
Compliance
Jan 1, 2027 ·
in 2 months
Colorado AI Act
AG rules due
Attorney General must adopt rules clarifying the post-adverse-outcome disclosure requirements.
Colorado
Sunset
Jan 1, 2030 ·
in 3.2 years
Colorado AI Act
Mandatory cure period ends
The AG's obligation to offer a 60-day notice-and-cure period expires.
Colorado
Past deadlines
Transition ends
Jun 30 ·
4 months ago
Colorado AI Act
Delayed effective date (superseded)
SB 25B-004 date; superseded by SB 26-189 before it arrived, so no obligations applied.
Colorado
Milestone
May 14 ·
5 months ago
Colorado AI Act
SB 26-189 signed (repeal and reenact)
SB 26-189 replaces SB 24-205 with a narrower ADMT disclosure framework and moves the effective date to January 1, 2027.
Colorado
Transition ends
Feb 1 ·
9 months ago
Colorado AI Act
Original effective date (superseded)
Original SB 24-205 date; postponed by SB 25B-004, so no obligations applied.
Colorado
Takes effect
Oct 1, 2025 ·
13 months ago
Colorado Privacy Act (CPA)
Minors' data amendment (SB 24-041) effective
Controllers offering online services to minors must use reasonable care, conduct assessments, and obtain consent for targeted ads, sale and certain profiling of minors.
Colorado
Transition ends
Aug 28, 2025 ·
14 months ago
Colorado AI Act
SB 25B-004 delays the act
Special-session bill pushes the SB 24-205 effective date from February 1, 2026 to June 30, 2026.
Colorado
Takes effect
Jul 1, 2025 ·
16 months ago
Colorado Privacy Act (CPA)
Biometric identifier amendment (HB 24-1130) effective
Any controller processing biometric identifiers must adopt a written biometric policy, give notice, obtain consent and follow retention/deletion rules.
Colorado
Takes effect
May 23, 2025 ·
17 months ago
Colorado Privacy Act (CPA)
SB 25-276 geolocation and sensitive-data sale amendment effective
Adds precise geolocation data definitions and prohibits selling sensitive data without consent (effective on signature).
Colorado
Enforcement
Jan 1, 2025 ·
22 months ago
Colorado Privacy Act (CPA)
60-day cure period expires
Mandatory 60-day notice-and-cure before AG enforcement ends; enforcement may proceed without cure.
Colorado
Compliance
Jul 1, 2024 ·
2.3 years ago
Colorado Privacy Act (CPA)
Universal opt-out mechanism recognition required
Controllers must honor AG-recognized universal opt-out mechanisms (e.g. Global Privacy Control).
Colorado
Milestone
May 17, 2024 ·
2.4 years ago
Colorado AI Act
SB 24-205 signed
Governor Polis signs the original Colorado AI Act with a February 1, 2026 effective date.
Colorado
Takes effect
Jul 1, 2023 ·
3.3 years ago
Colorado Privacy Act (CPA)
CPA takes effect
Core consumer rights and controller duties apply.
Colorado
Regulationsby Glyph