Colorado Privacy Act

Also known as: CPA, SB 21-190, Colorado Privacy Act

Colorado Privacy Act (SB 21-190) and CPA Rules (4 CCR 904-3) — Colorado General Assembly; Colorado Attorney General (rules)

Official site Official change log Subscribe to Colorado Privacy Act (RSS)

Colorado's comprehensive consumer privacy statute: controllers owe residents access, correction, deletion and portability, must honour a universal opt-out signal for targeted advertising and sales, and must run data protection assessments for high-risk processing. Enforced by the Attorney General, who also writes the implementing rules. What we watch here is those rules - the Colorado Privacy Act Rules, 4 CCR 904-3, in the Code of Colorado Regulations - so a new version of the rules shows up on this page; amendments to the statute itself are not tracked separately.