When does Colorado Privacy Act (CPA) take effect?

Colorado Privacy Act (CPA) took effect on Jul 1, 2023.

Who does Colorado Privacy Act (CPA) apply to?

Controllers doing business in Colorado or targeting Colorado residents that control or process personal data of 100,000+ consumers per year, or derive revenue or discounts from selling personal data and process personal data of 25,000+ consumers. Biometric provisions (HB 24-1130) and minors' provisions (SB 24-041) apply regardless of these volume thresholds.

What are the penalties under Colorado Privacy Act (CPA)?

Violations are deceptive trade practices under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation (up to $50,000 per violation against an elderly person), per C.R.S. 6-1-112. 60-day cure period applied only until Jan 1, 2025.

Colorado Privacy Act (CPA)

Amended Colorado · In force Jul 1, 2023 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Takes effectOct 1, 2025 · 13 months ago · Source

Minors' data amendment (SB 24-041) effectiveControllers offering online services to minors must use reasonable care, conduct assessments, and obtain consent for targeted ads, sale and certain profiling of minors.

Takes effectJul 1, 2025 · 16 months ago · Source

Biometric identifier amendment (HB 24-1130) effectiveAny controller processing biometric identifiers must adopt a written biometric policy, give notice, obtain consent and follow retention/deletion rules.

Takes effectMay 23, 2025 · 17 months ago · Source

SB 25-276 geolocation and sensitive-data sale amendment effectiveAdds precise geolocation data definitions and prohibits selling sensitive data without consent (effective on signature).

EnforcementJan 1, 2025 · 22 months ago · Source

60-day cure period expiresMandatory 60-day notice-and-cure before AG enforcement ends; enforcement may proceed without cure.

ComplianceJul 1, 2024 · 2.3 years ago · Source

Universal opt-out mechanism recognition requiredControllers must honor AG-recognized universal opt-out mechanisms (e.g. Global Privacy Control).

Takes effectJul 1, 2023 · 3.3 years ago · Source

CPA takes effectCore consumer rights and controller duties apply.

Summaries for reference, not legal advice. Check the official text.

What it does

Comprehensive privacy law giving Colorado consumers rights to access, correct, delete, port and opt out of targeted advertising, sale and certain profiling, with mandatory recognition of universal opt-out mechanisms and data protection assessments for high-risk processing. 2024 amendments added biometric identifier duties (July 1, 2025) and heightened protections for minors under 18 (Oct 1, 2025); 2025's SB 25-276 expanded precise geolocation rules and requires consent before selling sensitive data.

Who it applies to: Controllers doing business in Colorado or targeting Colorado residents that control or process personal data of 100,000+ consumers per year, or derive revenue or discounts from selling personal data and process personal data of 25,000+ consumers. Biometric provisions (HB 24-1130) and minors' provisions (SB 24-041) apply regardless of these volume thresholds.
Penalties: Violations are deceptive trade practices under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation (up to $50,000 per violation against an elderly person), per C.R.S. 6-1-112. 60-day cure period applied only until Jan 1, 2025.
Enforced by: Colorado Attorney General and district attorneys
Official name: Colorado Privacy Act (SB 21-190), C.R.S. 6-1-1301 et seq., as amended by HB 24-1130, SB 24-041 and SB 25-276
Citation: SB 21-190 (2021 Colo. Sess. Laws ch. 483); C.R.S. 6-1-1301 to 6-1-1313; 4 CCR 904-3 (CPA Rules)
Topics: Privacy, Children, Biometrics

Verified 2026-09-22 leg.colorado.gov leg.colorado.gov leg.colorado.gov coag.gov

Research notes

CO AG site (coag.gov) could not be fetched directly during verification; dates taken from leg.colorado.gov bill pages. The separate Colorado AI Act (SB 24-205, rewritten 2026) is a distinct law not covered here. No 2026 CPA amendments were confirmed; web search budget ran out before a full 2026 session check.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

EnactedCalifornia

California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months

In forceCalifornia

California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months

In forceCalifornia

California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months

Questions about Colorado Privacy Act (CPA)

What are the Colorado Privacy Act (CPA) compliance deadlines?: Jul 1, 2023: CPA takes effect. Jul 1, 2024: Universal opt-out mechanism recognition required. Jan 1, 2025: 60-day cure period expires. May 23, 2025: SB 25-276 geolocation and sensitive-data sale amendment effective. Jul 1, 2025: Biometric identifier amendment (HB 24-1130) effective. Oct 1, 2025: Minors' data amendment (SB 24-041) effective.
When does Colorado Privacy Act (CPA) take effect?: Colorado Privacy Act (CPA) took effect on Jul 1, 2023.
Who does Colorado Privacy Act (CPA) apply to?: Controllers doing business in Colorado or targeting Colorado residents that control or process personal data of 100,000+ consumers per year, or derive revenue or discounts from selling personal data and process personal data of 25,000+ consumers. Biometric provisions (HB 24-1130) and minors' provisions (SB 24-041) apply regardless of these volume thresholds.
What are the penalties under Colorado Privacy Act (CPA)?: Violations are deceptive trade practices under the Colorado Consumer Protection Act: civil penalties up to $20,000 per violation (up to $50,000 per violation against an elderly person), per C.R.S. 6-1-112. 60-day cure period applied only until Jan 1, 2025.

Deadlines

What it does

Related