Law / United States / 
Colorado
SB 21-190, Colorado Privacy Act (CPA)
C.R.S. sections 6-1-1301 et seq.
In force since .
A comprehensive regime rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- If you process the personal data of Colorado residents at the qualifying volume thresholds, give clear privacy notice and honor consumer requests to access, correct, delete, and port their data within 45 days.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P3
- Obtain the consumer's affirmative opt-in consent before processing or selling sensitive data, including biometric data used for identification and precise geolocation data, or before resuming processing for targeted advertising or sale after a consumer opts out.NIST Privacy FrameworkCT.PO-P1
- Offer consumers a way to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects, and complete a data protection assessment before processing that presents a heightened risk of harm.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkID.RA-P3
These lines are LexLint's reading of the law's text. Also read by: Colorado Department of Law, Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P3Potential problematic data actions and associated problems are identified.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://coag.gov/resources/colorado-privacy-act/
- Guidance body
- Colorado Department of Law, Office of the Attorney General
- Open questions
- What makes a commercial product or service "targeted to residents of Colorado" for a controller located outside Colorado whose service is offered nationally, under C.R.S. 6-1-1304?
What it makes you log
Who may demand the log
Regulator
Logging duty
A controller may not run processing that presents a heightened risk of harm (targeted advertising or profiling with foreseeable risk, sale of personal data, processing sensitive data) without conducting and documenting a data protection assessment, and must make it available to the Attorney General on request. The section states no period for keeping the assessment and does not list what the record must show beyond the weighing of benefits and risks in subsection (3); a three-year retention period appears in Rule 8.05(E) of 4 CCR 904-3, which is a separate row. The "conducts business in Colorado" prong of section 6-1-1304(1)(a) is not coded as a hook value; the targeting prong is.
- Kind
- Implicit
- As of
- Provision
- C.R.S. 6-1-1309(1) and (4) (a documented data protection assessment of each heightened-risk processing activity, made available to the Attorney General on request)
- Trigger
- personal_data_processing
What this law does
Colorado's omnibus data-privacy statute requires a controller that conducts business in or intentionally targets Colorado residents, and meets a 100,000-consumer or a 25,000-consumer-plus-sale-revenue threshold, to give consumers notice, minimize collection, obtain affirmative opt-in consent before processing sensitive data or resuming processing after an opt-out, and honor rights to access, correct, delete, and port personal data.
Processors must follow controller instructions and assist with compliance, and a controller must complete a data protection assessment before processing that presents a heightened risk of harm. SB 25-276 (chapter 240 of the 2025 Colorado session laws) took effect on . It defines precise geolocation data as information derived from technology that accurately identifies the present or past location of a device that links or is linkable to an individual within a radius of 1,850 feet.
It makes precise geolocation data sensitive data. It also bars a controller from selling a consumer's sensitive data without the consumer's consent.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions, processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .