Colorado Privacy Act (“CPA”) (Colo. Rev. Stat. §§ 6-1-1301, et seq.) (Amended May 2025)

Colorado Privacy Act (“CPA”)

OFFICIAL CITATION: Colo. Rev. Stat. §§ 6-1-1301, et seq., Title 6, Article 1, Part 13 – Colorado Privacy Act.
ORIGINAL LEGISLATION: Senate Bill 21-190 (2021).
EFFECTIVE DATE: July 1, 2023.
STATUS: Enacted and operative; amended by subsequent legislation, including House Bill 24-1130 (2024), Senate Bill 24-041 (2024), and Senate Bill 25-276 (2025).

 

SUMMARY:
The Colorado Privacy Act (“CPA”) establishes consumer privacy rights and compliance requirements for covered organizations that collect, use, process, or disclose personal data of Colorado residents.
The law addresses consumer rights, privacy notices, sensitive data, data protection assessments, targeted advertising, personal-data sales, universal opt-out mechanisms, processor relationships, and enforcement by the Colorado Attorney General and district attorneys.
Subsequent amendments have expanded Colorado’s privacy protections. House Bill 24-1130 introduced additional requirements for biometric identifiers and biometric data, effective July 1, 2025. Senate Bill 24-041 established enhanced protections for minors’ online personal data, effective October 1, 2025. Senate Bill 25-276 expanded sensitive-data protections to address precise geolocation information.
Organizations should review the current statutory provisions, applicable amendments, and Colorado Privacy Act Rules when evaluating their Colorado privacy obligations.

 

OFFICIAL LEGAL SOURCES:
Last Reviewed: October 16, 2026

 

These materials were obtained directly from the State Government public websites and are posted here for your review and reference only.  No Claim to Original State Government Works.  This may not be the most recent version.  The State may have more current information.  We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to.  Please check the linked sources directly.