Colorado Privacy Act: CPA Compliance
What is the CPA?
The Colorado Privacy Act (CPA) was the third modern and comprehensive data privacy law passed in the U.S. after Virginia’s. It came into effect in 2023. It gives Colorado residents greater control over their personal data and requires businesses to be transparent about data collection and use. It also gives individuals rights, including access, deletion, and opt-out from targeted advertising, sale or profiling using their personal data.
Common CPA questions and answersCOMPLIANCE To comply with the CPA, businesses must provide clear, up-to-date privacy notices, disclose data collection and sharing practices, and enable Colorado residents’ right to opt out of data sales and other covered uses. They must also obtain parental consent before collecting or processing minors’ personal data.
RISKS
Fines and other penalties are not explicitly specified under the CPA. They are governed by the Colorado Consumer Protection Act, and range from $2,000–20,000 per violation to $10,000–50,000 per violation, if against an elderly person.
The CPA no longer has a cure period. Other 2025 updates included changes to companies’ compliance requirements, including for employers and restrictions regarding minors.
your questions answered We’re happy to answer questions about data privacy, compliant marketing operations, and the CPA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
Contact sales
Learn more
Frequently asked questions
Under the Colorado Privacy Act, consumers have five specific rights:
- Right to access: any personal data that a company has collected about them
- Right to opt out: of data processing for targeted advertising, sale or profiling using their personal data
- Right to correction: any personal data that has been collected about them and is incorrect or outdated
- Right to deletion: any personal data that has been collected about them
- Right to data portability: to receive the personal data a company has about them in a readily portable format that can be transferred to another entity
The Colorado Attorney General enforces the CPA, and provides for a 60-day cure period. Penalties for CPA violations fall under deceptive trade practices, governed by the Colorado Consumer Protection Act. Fines can be from USD 2,000 to USD 20,000 per violation, or between USD 10,000 to USD 50,000 per violation against an elderly person.
CPA compliance software enables businesses to meet the requirements of the Colorado privacy law, like providing consumers with information about data processing and exercising their rights, and obtaining consent where required.
A consent management platform (CMP) is a type of CPA compliance software that enables companies to achieve and maintain CPA privacy compliance for websites and apps. A CMP’s banners present users with information about what cookies and other trackers are in use that collect personal information. They enable users to make informed and granular consent choices. They also securely store and document consent information over time, which users can update.