Colorado Privacy Act: Your Rights and How to Use Them
Colorado residents can ask companies to access, correct and delete their data and to stop selling it.
By Siddharth ShankarUpdated October 22, 2026The Colorado Privacy Act took effect on July 1, 2023. It applies to businesses that process personal data of more than 100,000 consumers a year, or sell data of 25,000 or more. Residents can ask to know, access, correct, delete and download their data, and opt out of its sale, targeted advertising and certain profiling. Companies must respond within 45 days, with one possible 45-day extension. Only the attorney general and district attorneys can enforce it, and you can complain through the attorney general’s office.
Before you start opt-outs, see which known data breaches already include your email.
Free · About 30 seconds · No sign-up · Email not stored
Colorado is one of several US states with a general privacy law. This guide uses the state attorney general’s summary page.
When it applies
The Colorado Privacy Act, or CPA, was signed on July 7, 2021 and went into effect on July 1, 2023. It covers entities that do business in Colorado or offer products or services aimed at Colorado residents and that either:
- process personal data of more than 100,000 consumers in a calendar year, or
- earn revenue or discounts from selling personal data of 25,000 or more consumers.
Service providers and contractors that handle data for these companies are also covered. Some entities and data are excluded, including financial institutions under the Gramm-Leach-Bliley Act and certain data governed by laws such as HIPAA and the Fair Credit Reporting Act.
Your rights
Colorado consumers have the right to:
- know whether a controller is collecting their personal data,
- access their personal data,
- correct their personal data,
- delete their personal data,
- download and transfer their data in a portable format,
- opt out of the sale of personal data, targeted advertising and certain profiling.
Removal is one half of the job. Check whether your email has leaked as well.
Free · About 30 seconds · No sign-up · Email not stored
Response times
Controllers must respond to requests within 45 days, with one possible 45-day extension.
Universal opt-out
Under the CPA, controllers had to accept opt-out requests through universal opt-out mechanisms from July 1, 2024. The Colorado Department of Law publishes a list of recognised mechanisms. A browser signal is one example of the idea. See how to turn on Global Privacy Control.
Sensitive data
Controllers need consent before collecting or processing sensitive data. That includes data about children under 13, race or ethnicity, religious beliefs, health conditions, sexual orientation, citizenship status and biometric data used for identification. The AG’s page says consent must be affirmative, freely given, specific, informed and unambiguous.
Who enforces it
The Attorney General’s Office and district attorneys have sole enforcement power. The page says private citizens cannot file lawsuits under the CPA. Where a violation can be remedied, the AG or DA had to send a letter giving 60 days to cure, and the page says that cure-notice process applied until January 1, 2025.
Putting your rights to use
Start with the company’s privacy page or request form, say which right you want to use and note the date you sent it. If 45 days pass without an answer, or the company refuses, you can take the matter to the attorney general’s office.
How to file a complaint
The page links to a complaint form at coag.gov/file-complaint and lists (720) 508-6000 for questions and comments.
Limits
The law has exemptions, and it covers only businesses that meet its thresholds. For listings on people-search sites, use each site’s own opt-out page. This is general information, not legal advice.
Sources
- Colorado Attorney General: Colorado Privacy Act (effective date, thresholds, rights, deadlines, enforcement, complaints)
Frequently asked questions
When did the Colorado Privacy Act take effect?
July 1, 2023.
Who does it apply to?
Businesses that process personal data of more than 100,000 consumers a year, or sell data of 25,000 or more consumers, and operate in or target Colorado.
What rights do I have?
Know, access, correct, delete and download your data, and opt out of sales, targeted advertising and certain profiling.
How long do companies have to respond?
45 days, with one possible 45-day extension.
Can I sue under the CPA?
No. The AG’s page says only the attorney general and district attorneys can enforce it.
See if your email has already leaked
- Checks your email against known data breaches
- Shows which sites leaked it, when, and what leaked
- We do not store the email you check
Compare data removal services
See which services work in your country, what they cost, and the free do-it-yourself route.
Compare removal services →Prefer a one-time report first? Scan My Shadow, our sister service, $9.99.