Fast.  Secure.  Free.  Forever.
Colorado State Privacy Law
Effective July 1, 2023

Colorado Privacy Act
(CPA)

The Colorado Privacy Act (CPA) gives Colorado residents the right to access, delete, and opt out of the sale of their personal data — including via universal opt-out signals.

CPA
Law Abbreviation
$20,000
Max Fine Per Violation
45
Days to Respond
100,000
Coverage Threshold
Your Rights Under CPA

What the law gives you

The Colorado Privacy Act (CPA) grants residents the following legally enforceable rights over their personal data:

Access
Know what personal data a company holds about you and how it’s used.
Delete
Request deletion of personal data provided by you or collected about you.
Correct
Require companies to correct inaccurate personal data.
Portability
Receive your data in a usable electronic format.
Opt Out
Opt out of targeted advertising, data sales, and profiling that produces legal effects.
Universal Opt-Out
Use a universal opt-out signal (like the GPC browser signal) to opt out automatically.
How to Exercise Your Rights

Step by step

01
Submit a rights request via the company’s designated privacy mechanism or the GPC browser signal.
02
The company has 45 days to respond, extendable by another 45 days with notice.
03
Appeal denied requests within the appeal process the company must provide.
04
File a complaint with the Colorado AG’s office if your appeal is denied.
ClickOff makes this automatic. Rather than submitting individual requests to hundreds of data brokers, ClickOff acts as your authorized agent under the CPA and all applicable state laws — submitting deletion requests to 200+ brokers simultaneously. Free forever.
Delete your data under CPA.
Free forever. Legal receipt generated instantly. 45-day compliance clock starts now.
Delete My Data From Every Broker →
Related Laws

Other privacy laws that protect you

CCPA — California → SB 362 — Delete Act → ADPA — Federal → All Your Rights →
CPA questions
Colorado privacy law,
explained.
What is the universal opt-out mechanism?
Colorado requires companies to honor universal opt-out signals like the Global Privacy Control (GPC) browser setting. Enable it in your browser to automatically opt out of data sales across all CPA-compliant sites.
Does the CPA require opt-in consent?
For sensitive data (health, biometric, genetic, precise geolocation, race/ethnicity, sexual orientation, children’s data), companies must obtain opt-in consent before processing.
Who enforces the Colorado Privacy Act?
The Colorado Attorney General and district attorneys. Companies get a 60-day cure period for first violations before fines are imposed.
How does ClickOff help me use my CPA rights?
ClickOff acts as your authorized agent under the CPA and all applicable state laws. Instead of sending individual deletion requests to hundreds of data brokers one by one, ClickOff submits on your behalf to 200+ brokers simultaneously — with a legal receipt generated instantly. Free forever.