Colorado

Colorado privacy law: honoring the signal is mandatory

Colorado was the first state to publish an official list of recognized opt-out signals, and its Attorney General names Global Privacy Control as the only one considered valid. If you serve Coloradans, that is a technical obligation, not a policy statement.

At a glance

Applies if: You are a Colorado business, or you offer products or services intentionally targeted to Colorado residents, and you either process personal data of 100,000 or more consumers in a calendar year, or you derive revenue or receive a discount from the sale of personal data and process 25,000 or more consumers (§6-1-1304(1)(a)(I)). Biometric processing has separate coverage regardless of volume. There is no fixed dollar-revenue test.
Opt-out signal: Required. On and after July 1, 2024 you must honor an opt-out preference signal for sale and targeted advertising (§6-1-1306(1)(a)(IV)(B); 4 CCR 904-3, Rules 5.01–5.07). The Attorney General's official page identifies Global Privacy Control as the only universal opt-out mechanism considered valid.
Response deadline: 45 calendar days, extendable by 45 additional days (§6-1-1306(2)(a)). An appeals process is required: consumers may appeal within 45 days and you have 60 additional days to decide (§6-1-1306(3)(a)–(b)).
Right to cure: The general mandatory cure right is repealed (§6-1-1311(1)(d)(I)). A narrow exception remains for the minors provisions, where notice and a 60-day cure may be offered; that exception repeals effective December 31, 2026 (§6-1-1311(1)(d)(II)).
Max penalty: Up to $20,000 per violation under the consumer protection statute (§6-1-112(1)(a)), with each affected consumer or transaction a separate violation. Enforced by the Attorney General and district attorneys (§6-1-1311(1)).
Consumer rights: access · correction · deletion · portability · opt out of sale · opt out of targeted advertising · opt out of profiling with legal or similarly significant effects · consent for sensitive data

Colorado Privacy Act, Colo. Rev. Stat. §6-1-1301 et seq.; rules at 4 CCR 904-3 — in force July 1, 2023.

The signal requirement is the one most sites miss

Posting an opt-out link is not enough in Colorado. When a visitor's browser sends a Global Privacy Control signal, that signal has to be treated as a valid opt-out of sale and targeted advertising (§6-1-1306(1)(a)(IV)(B)). In practice this means your tag manager, consent tool, and analytics stack all have to respond to it — and a banner that only appears for new visitors does not.

What else Colorado requires

Data minimization and limits on secondary use (§6-1-1308(3)–(4)).
Consent, a retention and deletion policy, and employee-specific restrictions for biometric data (§6-1-1308(7), (9)).
Enhanced duties for minors' data (§6-1-1308.5).
A universal opt-out mechanism pathway for sale and targeted advertising (4 CCR 904-3, Rules 5.01–5.07).

Coverage is counted in people, not dollars

The 100,000-consumer test is met by reach, so a chain with a Colorado storefront or an e-commerce brand shipping into the state can clear it without thinking about it. The alternative test — revenue or a discount from selling data plus 25,000 consumers — catches businesses that monetize audiences (§6-1-1304(1)(a)(I)).

Where Colorado sites usually break

Dealership lead forms and chain loyalty programs count toward coverage, and financing-related GLBA exemptions need separate analysis (§6-1-1304(1), (2)(j)). Applicant screening generally falls outside consumer scope, but biometric employment processing has express rules, and e-commerce pixels or lead sales require the advertising and sale opt-outs, including the signal (§§6-1-1303(6), 6-1-1308(9), 6-1-1306(1)(a)).

Primary sources

Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.

Free Opt-Out Audit

See whether your opt-outs actually work.

Run my free audit