Colorado Privacy Act compliance
Colorado made the browser opt-out signal mandatory.
Since 1 July 2024, websites covered by the Colorado Privacy Act must treat a Global Privacy Control signal as an opt-out from targeted advertising and the sale of personal data. ConsentBit honors it automatically, blocks the trackers behind it, and records every choice.
Key facts
Colorado’s privacy law, with the highest penalties of any state ConsentBit covers.
The Colorado Privacy Act (CPA) protects the personal data of Colorado residents. It sits inside Colorado’s Consumer Protection Act, so a privacy violation counts as a deceptive trade practice. The Attorney General and district attorneys enforce it, and consumers can’t sue a business directly under this law.
$20,000
per violation, under Colorado’s Consumer Protection Act.
Requirements
Five things Colorado expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
Tell visitors what you collect and how to opt out
The banner explains that data is collected, as soon as visitors land.
Offer an opt-out of targeted advertising, sale and profiling
The banner shows a “Do Not Share My Personal Information” link, and you can edit the label.
Honor Global Privacy Control as an opt-out
ConsentBit detects the signal and opts the visitor out automatically. It’s on by default.
Act on the opt-out
Tracking scripts are blocked the moment a visitor opts out or a GPC signal arrives.
Keep a record of requests
Every opt-out is logged with the date and time. Opt-outs from a browser signal are recorded the same way as ones from the banner link.
How it works
What a visitor sees, step by step
Nothing is blocked by default. In Colorado, the visitor’s browser can make the choice for them.
They land on your site
A notice explains that data is collected. Your scripts run as normal.
Their browser may opt out first
If the browser sends Global Privacy Control, ConsentBit applies the opt-out straight away, with no click.
Or they click the opt-out link
“Do Not Share My Personal Information” opens the opt-out panel, with a single checkbox.
The tracking stops
Analytics, Marketing and Preferences scripts are blocked. Necessary cookies keep running.
Global Privacy Control
One signal, recognized by the state itself.
Colorado is the only state that publishes an official list of browser opt-out signals it recognizes. Global Privacy Control was the first on that list, and it is still the only one. If a Colorado visitor arrives with GPC turned on, a covered business has to treat it as an opt-out from targeted advertising and the sale of their data.
ConsentBit honors Global Privacy Control in every US state, so a Colorado visitor and a Virginia visitor get the same result, even though only Colorado requires it.
Runs until they opt out
For US visitors, ConsentBit uses an opt-out model. Here’s what runs by default in Colorado, and what changes after an opt-out or a GPC signal.
No more grace period
Colorado used to give businesses 60 days to fix a violation before any action. That window closed on 1 January 2025 for most violations, so an enforcement letter can now come without one.
A deceptive trade practice
Because the law sits inside Colorado’s Consumer Protection Act, a privacy violation is treated as a deceptive trade practice, which is how the $20,000 penalty applies.
California’s rules differ again, with a wider definition of sharing. See what CCPA requires →
Honor Global Privacy Control automatically, free.
Records
A record of every opt-out, ready if the Attorney General asks
Every choice is recorded with when it was made and whether the visitor opted out. Opt-outs that arrive as a browser signal are recorded the same way as ones made on the banner. You can export the log as a CSV file whenever you need it.
The visitor opted out, so targeted advertising and sale scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
FAQ
Colorado privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
It applies to businesses that sell to or target people in Colorado and either control or process the personal data of 100,000 or more consumers in a calendar year, or control or process the data of 25,000 or more consumers while making money or getting a discount from selling personal data. Colorado sets no revenue threshold, so smaller businesses can be covered.
Yes. Since 1 July 2024, covered businesses must treat a Global Privacy Control signal as an opt-out from targeted advertising and the sale of personal data. Colorado’s Attorney General keeps a public list of recognized signals, and GPC is still the only one on it.
A violation counts as a deceptive trade practice under Colorado’s Consumer Protection Act, which carries civil penalties of up to $20,000 per violation. That makes Colorado the most expensive of the US state laws ConsentBit covers.
Not for most violations. Businesses used to get 60 days’ notice to fix a problem before any enforcement action, but that ended on 1 January 2025. A limited cure period still applies to some newer parts of the law until the end of 2026.
No. The Attorney General and district attorneys have exclusive authority to enforce it, and the law says it provides no basis for a private right of action.
Colorado residents can ask to see, correct, delete or take a copy of their personal data, and they can opt out of targeted advertising, the sale of their data, and profiling that has legal or similarly significant effects. Businesses also need opt-in consent before processing sensitive data.
Colorado requires Global Privacy Control, as California does, while Virginia doesn’t. Colorado’s penalties are the highest of the three, and its cure period has expired. California also lets consumers sue over certain data breaches, which Colorado and Virginia don’t. See what VCDPA requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
RELATED READING
Keep reading
Meet Colorado’s opt-out rules without extra work
Honor Global Privacy Control automatically, block the trackers behind an opt-out, and keep a record of every choice.
This page is a general overview of the Colorado Privacy Act, not legal advice. Colorado has added rules since the law took effect, including requirements for biometric data and extra protections for people under 18.