The Colorado Privacy Act (CPA) lets websites set analytics and advertising cookies without prior consent, but it requires an opt-out of targeted advertising and data sales, and since 1 July 2024 it requires businesses to honour Global Privacy Control (GPC) as a universal opt-out. Opt-in consent applies to sensitive data, and since 1 October 2025 to targeted advertising, sales and profiling involving known minors. Violations are deceptive trade practices, with civil penalties of up to $20,000 per violation.
What the Colorado Privacy Act covers
The Colorado Privacy Act, enacted as SB 21-190, took effect on 1 July 2023. It applies to any entity that conducts business in Colorado or deliberately targets Colorado residents with products or services, provided the entity meets one of two thresholds: processing personal data of at least 100,000 consumers per calendar year, or processing personal data of at least 25,000 consumers while also deriving revenue or receiving a discount from selling that data.
Unlike the CCPA, Colorado does not impose a separate revenue threshold. The law defines a "consumer" as a Colorado resident acting in an individual or household context, excluding employees and business contacts.
The CPA gives Colorado residents the right to access, correct, delete and obtain a portable copy of their personal data, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling activities. Rules that implement these rights are listed on the Colorado Attorney General's CPA page.
Cookie consent under the CPA is opt-out, not opt-in
The CPA follows an opt-out model for most cookie-based tracking. Businesses are not required to obtain prior consent before setting cookies that collect personal data for analytics or advertising. This contrasts sharply with the GDPR's opt-in requirement, where cookies may not fire until a visitor actively consents.
There is one significant exception. Cookies or tracking technologies that collect sensitive personal data require opt-in consent before processing. Sensitive data under the CPA includes racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sex life or sexual orientation, citizenship status, genetic or biometric identifiers, and data from a known child.
If your website sets cookies that collect any of these categories, you must obtain affirmative consent before those cookies fire.
The universal opt-out mechanism requirement
Since 1 July 2024, controllers subject to the CPA that process personal data for targeted advertising or the sale of personal data must recognise and honour a universal opt-out mechanism (UOOM). According to the Attorney General's universal opt-out page, Global Privacy Control was the first UOOM recognised under the CPA and is currently the only one the Department of Law considers valid.
GPC is a browser-level signal transmitted via the Sec-GPC HTTP header. When a visitor's browser sends Sec-GPC: 1, your website must treat this as a valid opt-out request for both targeted advertising and data sales. You cannot require the visitor to take additional steps, such as filling in a form or clicking through a separate opt-out page.
This requirement aligns Colorado with California's CCPA opt-out rules, which also mandate GPC recognition. Several other states have followed suit, including Connecticut and Montana.
What happens if you ignore GPC signals
Failing to honour GPC signals is a violation of the CPA. The Department of Law says its list of recognised mechanisms is the one it "will prioritize for enforcement". The 60-day cure period ran only until 1 January 2025, so the Attorney General no longer has to offer a chance to fix a violation before acting.
Applicability thresholds in detail
The two applicability thresholds deserve careful attention. The 100,000-consumer threshold counts all Colorado residents whose personal data you control or process in a calendar year, not just those who interact with cookies or tracking. The 25,000-consumer threshold applies only if you also derive revenue or receive a discount from selling personal data.
| Requirement | Details |
|---|---|
| Effective date | 1 July 2023 |
| UOOM requirement date | 1 July 2024 |
| Cure period expiry | 1 January 2025 |
| Biometric rules (HB24-1130) | 1 July 2025 |
| Protections for minors (SB24-041) | 1 October 2025 |
| Threshold A | 100,000 or more Colorado consumers' data processed per year |
| Threshold B | 25,000 or more consumers' data processed, plus revenue or discounts from data sales |
| Recognised UOOM | Global Privacy Control (GPC) |
| Consent model (general) | Opt-out |
| Consent model (sensitive data and minors) | Opt-in |
| Maximum penalty | Up to $20,000 per violation |
| Enforced by | Colorado Attorney General and District Attorneys |
Changes since 2024: biometrics and minors
Two 2024 amendments have since taken effect. SB24-041, in force since 1 October 2025, bars a controller from processing a known minor's personal data for targeted advertising, sales or profiling with legal or similarly significant effects unless the minor, or a parent for a child under 13, has consented. It applies regardless of the volume thresholds, and the Attorney General ran a 2025 rulemaking on it.
HB24-1130, in force since 1 July 2025, adds rules for biometric identifiers: a written retention and deletion policy, disclosure and consent before collection, and limits on how employers can ask for consent.
How to detect and honour GPC on your website
Implementing GPC signal detection involves checking for the Sec-GPC header on the server side or the navigator.globalPrivacyControl property in JavaScript. When either returns a truthy value, your site must stop the cookies used for targeted advertising and data sales.
Practically, this means your cookie consent management platform should:
- Detect the GPC signal before loading any tracking scripts
- Automatically set the visitor's opt-out preference for advertising and sale categories
- Continue to allow strictly necessary cookies (session identifiers, shopping cart tokens) regardless of GPC status
- Log the GPC-based opt-out for your records
A common mistake is treating GPC as a blanket rejection of all cookies. GPC specifically covers targeted advertising and data sales. Functional cookies and strictly necessary cookies are unaffected.
CPA, CCPA and GDPR side by side
Website owners operating across multiple jurisdictions need to understand where the CPA sits relative to other major frameworks, and the overview of global privacy laws covers the rest.
| Feature | CPA (Colorado) | CCPA (California) | GDPR (EU and EEA) |
|---|---|---|---|
| Cookie consent model | Opt-out | Opt-out | Opt-in |
| GPC recognition required | Yes (since July 2024) | Yes | No |
| Sensitive data | Opt-in consent | Right to limit use | Opt-in consent (Article 9) |
| Revenue threshold | None | $26,625,000 | None |
| Cure period | Expired January 2025 | No right to cure | None |
| Enforcement body | AG and District Attorneys | AG and CPPA | National DPAs |
The practical takeaway: if your site already honours GPC and provides a clear opt-out mechanism, the CPA's cookie rules are within reach. The harder work comes from sensitive data, minors' data and data subject rights.
Enforcement since 2025
As of October 2026, publicly disclosed CPA fines have not been widely reported. The Attorney General has acted on GPC, though: on 9 September 2025 it joined the CPPA and the Attorneys General of California and Connecticut in a joint investigative sweep of businesses that appeared not to process GPC opt-outs, sending letters that asked them to comply.
Violations of the CPA are treated as deceptive trade practices under Colorado's Consumer Protection Act. HB19-1289 raised the civil penalty that the Attorney General or a District Attorney can seek from $2,000 to $20,000 per violation, and to $50,000 where the victim is an elderly person. For a website with significant Colorado traffic, a systematic failure to honour GPC signals could accumulate substantial liability.
Businesses that process personal data for targeted advertising should treat GPC support as non-optional.
Practical steps to meet the CPA's rules
Start with a cookie audit. Identify every cookie and tracker your site sets, classify them by purpose, and determine which ones fall under "targeted advertising" or "sale of personal data" as defined by the CPA.
Configure your consent management platform to detect GPC signals automatically. When Sec-GPC: 1 is present, the platform should stop all non-essential advertising and sale-related cookies without requiring visitor interaction.
Review your data inventory for sensitive categories. If any cookies collect health information, biometric data, or data about children or minors you know about, switch those to an opt-in model with affirmative consent before the cookie fires.
Update your privacy policy to disclose CPA-specific rights, including the right to opt out via universal opt-out mechanisms. Provide a clear description of how your site recognises GPC.
Document what you have done. If the AG sends an inquiry, having a clear record of your GPC implementation, cookie categories, and consent processes will make the response far simpler.
How the CPA fits into the broader US privacy picture
Colorado was the third US state to pass a comprehensive privacy law, following California and Virginia. As of October 2026, 23 states have enacted one and 19 are in force. Many of these laws, including Connecticut's CTDPA, Montana's MCDPA and Oregon's OCPA, also require GPC recognition.
For a full breakdown of how these frameworks compare, see the US state privacy laws comparison guide.
Universal opt-out signals are becoming a baseline requirement across US jurisdictions. Implementing GPC support now covers the same duty in several state laws at once.
Short answers on the Colorado Privacy Act
Does the Colorado Privacy Act require cookie consent banners?
The CPA does not require an opt-in cookie banner like the GDPR does. It requires an opt-out mechanism and recognition of GPC signals. A cookie banner offering opt-out choices is still a practical way to be transparent and to collect consent where sensitive data or known minors are involved.
What is Global Privacy Control and how does it work with the CPA?
Global Privacy Control is a browser signal sent via the Sec-GPC header. Under the CPA, businesses must treat this signal as a valid opt-out request for targeted advertising and data sales. It is the only universal opt-out mechanism currently recognised by the Colorado Attorney General.
Can I still use Google Analytics under the Colorado Privacy Act?
Yes, but if a visitor sends a GPC signal, you must stop any analytics cookies used for targeted advertising or cross-site tracking. Standard analytics for aggregate measurement may continue, provided the data is not sold or used for targeted ads.
What are the penalties for violating the Colorado Privacy Act?
Violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation, or $50,000 where the victim is an elderly person. The 60-day cure period ended on 1 January 2025.
Does the CPA apply to small businesses?
The CPA applies based on data processing volume, not company size. If your website processes personal data of 100,000 or more Colorado consumers a year, or 25,000 consumers while earning revenue or discounts from data sales, the law applies regardless of your revenue. The minors' protections in force since October 2025 apply regardless of these thresholds.
How does the CPA handle children's and minors' data?
Data from a known child under 13 is sensitive data, so it needs consent from a parent or guardian before processing. Since 1 October 2025, a controller also needs consent before using a known minor's data for targeted advertising, sales or significant profiling.
Check what your site shares with Colorado visitors
If you are not sure which cookies your site sets or whether your GPC handling covers them, start with a scan. Kukie.io detects and categorises the cookies on your site, blocks scripts until a choice where you use opt-in, and can treat a GPC signal as an automatic opt-out in the regions where you use an opt-out model.
