Does Colorado have a comprehensive privacy law? Yes. The Colorado Privacy Act, signed on July 7, 2021, has been in effect since July 1, 2023.
- Status: In Effect
- Law: Colorado Privacy Act (SB 21-190, 2021; C.R.S. § 6-1-1301 et seq.)
- Signed: July 7, 2021 · Effective: July 1, 2023
- Applies to: Controllers that conduct business in Colorado or deliver products or services intentionally targeted to Colorado residents and that control or process the personal data of 100,000 or more consumers in a calendar year, or derive revenue or receive a discount from the sale of personal data and control or process the personal data of 25,000 or more consumers. The protections for minors’ data added by SB 24-041 (effective October 1, 2025) apply regardless of these thresholds
- Cure period: No longer. A 60-day cure period (after a notice of violation, where a cure was deemed possible) was repealed on January 1, 2025
- Enforcement: Attorney General and district attorneys (exclusive); a violation is a deceptive trade practice under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation ($50,000 if committed against an elderly person); no private right of action
- Last verified: November 4, 2026 · Official source: SB 21-190 bill page (Colorado General Assembly)
- Related: Colorado Privacy Act: what you need to know
The Colorado Privacy Act gives Colorado consumers the right to opt out of targeted advertising, the sale of personal data and certain profiling, and the rights to access, correct, delete and obtain a portable copy of their personal data. Controllers must give a privacy notice, limit collection to what is necessary, secure personal data, get consent before processing sensitive data, and conduct data protection assessments for processing that presents a heightened risk of harm.
The Attorney General’s Colorado Privacy Act Rules (4 CCR 904-3) explain how to comply; the current version took effect on December 1, 2025. Since October 1, 2025, SB 24-041 has added protections for minors’ online data.
For the full background and the rules updates, see our Colorado Privacy Act guide.