What Is CPA
Colorado built the strongest state privacy framework.
The Colorado Privacy Act (CPA) became effective on July 1, 2023. It stands apart from other state privacy laws in three significant ways: the highest per-violation penalties in the country ($20,000), mandatory recognition of universal opt-out mechanisms (UOOM) like Global Privacy Control since July 1, 2024, and dual enforcement authority — both the Attorney General and District Attorneys can bring enforcement actions.
CPA also has something few other state laws can claim: active public enforcement. The Colorado AG has brought enforcement actions, conducted industry-wide sweeps, and issued public penalties. This isn't theoretical law — it's being enforced.
Your rights under CPA
Right to Access
Confirm whether a controller processes your personal data and obtain the data in a portable format.
Right to Correct
Fix inaccurate personal data that a controller holds about you.
Right to Delete
Request deletion of personal data a controller has collected about you.
Right to Portability
Receive your personal data in a readily usable format you can share with another controller.
Right to Opt Out
Opt out of processing for targeted advertising, data sales, or profiling for significant decisions.
Universal Opt-Out
Use GPC to broadcast your opt-out preference to every covered controller automatically.
Who has to comply with CPA
CPA applies to any controller conducting business in Colorado or targeting Colorado residents AND meeting one of these thresholds:
- Processes the personal data of at least 100,000 Colorado consumers during a calendar year, OR
- Derives revenue or receives a discount from the sale of personal data and processes data of at least 25,000 consumers
Unlike Virginia's 50% revenue threshold, Colorado's second threshold applies to any revenue or discount derived from data sales — a broader test that pulls more entities into compliance.
The Universal Opt-Out Mandate — Colorado's signature feature
Since July 1, 2024, controllers subject to CPA must recognize and honor universal opt-out signals like Global Privacy Control (GPC). The Colorado AG maintains a public list of recognized UOOMs, and GPC is currently the only mechanism on that list.
GPC is a browser-level signal that automatically communicates a consumer's opt-out preference to every website visited. For consumers, this eliminates the friction of clicking individual "Do Not Sell" links on thousands of sites. For businesses, it's a compliance obligation — ignoring GPC signals has become Colorado's top enforcement priority.
How It Compares
Colorado vs. California: the strictest two states
California and Colorado are widely regarded as the two strongest state privacy jurisdictions. California has more infrastructure (CPPA agency, DROP registry). Colorado has higher per-violation penalties and more immediate enforcement (no cure period since 2025).
Feature
Colorado (CPA)
California (CCPA + SB362)
Right to Delete
Yes, 45-day response
Yes, 45-day response
Centralized Delete Registry
No — per-controller requests
Yes — DROP (Aug 1, 2026)
Universal Opt-Out (GPC)
Required since July 2024
Required
Enforcement Authority
AG + District Attorneys
CPPA (dedicated agency)
Max Civil Penalty
$20,000 per violation
$7,500 per intentional
Series of Violations Cap
$500,000
None
Cure Period
Expired Jan 1, 2025
Removed Jan 2023
Private Right of Action
No
Limited (breach only)
The pattern is clear: Colorado front-loaded enforcement. California built a dedicated privacy agency and created the DROP registry infrastructure. Colorado used its existing consumer protection framework, added universal opt-out, and made penalties sharp enough to get attention. Both approaches work — but Colorado gets there with less bureaucracy.
Enforcement in Action
Colorado has actually enforced CPA.
Unlike many state privacy laws where enforcement is theoretical, Colorado has brought real actions with real consequences. A few highlights from 2024-2025 enforcement activity:
Case Study 2025
$250,000 Penalty Against AdTech Company
The Colorado AG's first post-cure-period enforcement action targeted an advertising technology company that had been ignoring GPC signals from 500,000+ Colorado users. The $250,000 civil penalty sent a clear message: universal opt-out signals are legally binding, and Colorado will enforce that.
Enforcement Sweep 2025
15+ Companies Notified in GPC Compliance Sweep
The Colorado AG conducted a proactive enforcement sweep in September 2025 focused on universal opt-out compliance. Over 15 companies received non-compliance notices. The sweep was timed months before the January 1, 2025 cure period expiration — giving non-compliant businesses one final chance to fix issues before direct penalties became possible.
Rule Updates 2026
Department of Law Rule Amendments Take Effect July 1, 2026
New CPA rule amendments will clarify requirements from SB 24-041 (children's data) and SB 25-276, update universal opt-out technical specifications, and finalize biometric data provisions added by HB 24-1130. Expected additions include explicit examples of noncompliant cookie-banner dark patterns and a safe-harbor cookie-banner template.
The Honest Version
What CPA still doesn't give you
CPA is the strongest state privacy law in terms of enforcement, but it shares gaps with every state except California. Here's what CPA does not give Colorado residents:
- No private lawsuits. Enforcement is AG/DA only. You cannot personally sue a controller for ignoring your CPA request.
- No centralized delete system. Unlike California's DROP, there's no one-click "delete from all Colorado brokers" infrastructure. You (or an agent) must submit requests to each controller.
- $500,000 cap per related series. A single company can face up to $500,000 in penalties for a related series of violations, which prevents the multi-million-dollar fines possible in California or Europe.
- 17 blanket exemptions. CPA exempts 17 categories of data including consumer reporting agency data, employment records, HIPAA-protected data, and data regulated by FERPA. These overlap significantly with VCDPA and TDPSA exemptions.
That said, the combination of universal opt-out mandates, active enforcement, and $20K per-violation penalties makes CPA uniquely effective. If you're a Colorado resident whose data got sold without your consent, CPA gives you more meaningful recourse than Virginia or Texas law provides.