Colorado Privacy Law (CPA): Compliance Guide
The Colorado Privacy Act, effective July 1, 2023, looks like a standard opt-out law on paper — but it changed US privacy compliance in practice by becoming the first state to make universal opt-out signals mandatory. Since July 1, 2024, every covered business must honor Global Privacy Control whether or not the visitor ever touches a privacy link. With penalties up to $20,000 per violation and the cure period eliminated on January 1, 2026, Colorado is now one of the riskiest states to get wrong.
- Effective
- July 1, 2023
- GPC / universal opt-out
- Required since July 1, 2024
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · Colorado Privacy Act (CPA)
Applicability
Who must comply with the CPA
The Colorado Privacy Act applies to businesses that meet the following criteria:
- Conducts business in Colorado or produces products or services targeted to Colorado residents, and:
- Controls or processes the personal data of 100,000 or more Colorado consumers, or
- Derives revenue from the sale of personal data and controls or processes the data of 25,000 or more Colorado consumers
Consumer rights
What Colorado consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of targeted advertising, the sale of personal data, and profiling
Opt-out mechanics
Colorado opt-out & GPC requirements
Like every US state privacy law, the CPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for Colorado is “Your Privacy Choices”.
Global Privacy Control: Required since July 1, 2024
Colorado was the first state to make a universal opt-out mechanism (UOOM) mandatory. Since July 1, 2024, covered businesses must honor browser and device-level signals such as Global Privacy Control across sale, targeted advertising, and profiling.
Enforcement
CPA penalties & enforcement
- Up to $20,000 per violation
Cure period: None. Colorado's right to cure was eliminated on January 1, 2026.
State quirks
What makes Colorado different
Colorado leads on three fronts. Its universal opt-out rule was the nation's first and covers sale, targeted advertising, and profiling. Its maximum penalty — $20,000 per violation — is the highest statutory figure among the 20 state laws. And since January 1, 2026 it no longer offers any cure period, so there is no grace window after an enforcement notice. Enhanced protections for minors and mandatory data protection impact assessments for high-risk processing round out one of the strictest operational regimes in the country.
Universal opt-out signals
Honoring signals like Global Privacy Control has been mandatory since July 1, 2024 — the first such requirement in the country.
No cure period (2026)
The right to cure violations was eliminated as of January 1, 2026, removing the grace window businesses previously had after an enforcement notice.
Enhanced protections for minors
Additional safeguards apply to children's data online beyond the standard consumer rules.
Data protection impact assessments
Required for processing that presents a heightened risk of harm to consumers.
Automation
How ConsentKit handles Colorado
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so Colorado visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- Colorado visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because Colorado requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for Colorado visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a Colorado visitor makes a choice.
Because Colorado has had no cure period since January 1, 2026, ConsentKit's automatic GPC honoring is your first line of defense — the widget never waits for a click when the visitor's browser has already opted out.
FAQ
Colorado CPA FAQ
Does the Colorado Privacy Act apply to my business?
It covers you if you conduct business in Colorado or target products or services to Colorado residents, and either control or process the personal data of 100,000 or more Colorado consumers, or derive revenue from selling personal data and process the data of 25,000 or more. The second prong has no revenue-percentage floor — any revenue from data sales counts.
Is Global Privacy Control mandatory in Colorado?
Yes. Colorado was the first state to make a universal opt-out mechanism mandatory, in force since July 1, 2024. Covered businesses must honor browser-level signals such as Global Privacy Control for opt-outs of sale, targeted advertising, and profiling.
Does Colorado still offer a cure period?
No. The right to cure was eliminated on January 1, 2026. Combined with penalties of up to $20,000 per violation — the highest among the 20 state laws — there is no longer a grace window to fix violations after enforcement begins.
What opt-out link does Colorado require?
A clear and conspicuous link — “Your Privacy Choices” is the accepted text — letting consumers opt out of targeted advertising, the sale of personal data, and profiling. Because GPC is mandatory, the link must work alongside automatic signal-based opt-outs, not instead of them.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the CPA.
Comply with Colorado's CPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.