# Colorado — US state consumer data privacy laws: applicability thresholds by state

For Colorado, law name and abbreviation is Colorado Privacy Act (CPA); effective date is July 1, 2023; consumer volume threshold is Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; revenue-from-data-sales threshold is Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more; threshold combination logic is OR — satisfies one or both of the following thresholds, recorded from its source on 2026-08-12.

- **State:** Colorado _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Colorado Privacy Act (CPA)
- **Effective date:** July 1, 2023
- **Consumer volume threshold:** Controls or processes the personal data of one hundred thousand consumers or more during a calendar year _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — satisfies one or both of the following thresholds _(verified: appears in the quote below)_
- **Key exemptions:** State and local government entities; financial institutions subject to GLBA; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education; air carriers
- **Enforcement mechanism:** Attorney General and district attorneys; civil penalty of up to $20,000 per violation; no private right of action
- **Statute citation:** C.R.S. §§ 6-1-1301 to 6-1-1313
- **Notes:** Colorado does not specify a minimum percentage of revenue from data sales — any revenue or discount from selling data combined with 25,000+ consumers triggers the law. As of October 1, 2025, the law also applies to any controller processing biometric identifiers or biometric data regardless of volume.

## What the source says

> (I) Controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or Colorado Revised Statutes 2024 Page 142 of 320 Uncertified Printout (II) Derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more.

## Source

- https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).