Colorado
For Colorado, law name and abbreviation is Colorado Privacy Act (CPA); effective date is July 1, 2023; consumer volume threshold is Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; revenue-from-data-sales threshold is Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more; threshold combination logic is OR — satisfies one or both of the following thresholds, recorded from its source on 2026-08-12.
- State
- Colorado our reading
- Law name and abbreviation
- Colorado Privacy Act (CPA)
- Effective date
- July 1, 2023
- Consumer volume threshold
- Controls or processes the personal data of one hundred thousand consumers or more during a calendar year verified
- Revenue-from-data-sales threshold
- Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more verified
- Threshold combination logic
- OR — satisfies one or both of the following thresholds verified
- Key exemptions
- State and local government entities; financial institutions subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; air carriers
- Enforcement mechanism
- Attorney General and district attorneys; civil penalty of up to $20,000 per violation; no private right of action
- Statute citation
- C.R.S. §§ 6-1-1301 to 6-1-1313
- Notes
- Colorado does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law. As of October 1, 2025, the law also applies to any controller processing biometric identifiers or biometric data regardless of volume.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
(I) Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or Colorado Revised Statutes 2024 Page 142 of 320 Uncertified Printout (II) Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more.
— leg.colorado.gov, retrieved 2026-08-12
Source
- leg.colorado.govhttps://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf