Sign in
Start free

United States

CPA

Colorado Privacy Act

The CPA is Colorado’s consumer privacy law. It is similar in shape to Virginia’s VCDPA, but it has stricter rules on dark patterns and requires businesses to honour the Global Privacy Control as an opt-out signal. It is enforced by the Colorado Attorney General and district attorneys.

Start free
Run a free scan

At a glance

Opt-out

Region
Colorado, USA
Status
In force since July 2023
Penalties
Up to USD 20,000 per violation under the Colorado Consumer Protection Act, and each consumer or transaction affected counts as a separate violation. Courts can also order injunctions. The 60-day right to cure ended on 1 January 2025.
Who it affects
Controllers, including nonprofits, that do business in Colorado or target its residents and control or process the personal data of 100,000 or more Colorado consumers a year, or of 25,000 or more while getting revenue or discounts from selling personal data. The biometric and minors’ data rules apply at any size.

What the CPA requires

  • Publish a privacy notice that describes categories of data and purposes.
  • Offer clear, easy-to-find opt-outs of targeted advertising, the sale of personal data and profiling used for decisions with legal or similarly significant effects.
  • Honour the Global Privacy Control as a universal opt-out signal.
  • Obtain opt-in consent before processing sensitive data.
  • Avoid dark patterns when asking for consent, because consent obtained through them does not count.
  • Conduct data protection assessments for high-risk processing.
  • Process consumer rights requests (access, correction, deletion, portability) within 45 days.

Your site’s footer

An example

  • Privacy policy
  • Terms
  • Do Not Sell or Share My Personal Information

What the banner does here

The same opt-out mode as California: no blocking wall, a “Do Not Sell or Share My Personal Information” link on every page, and a preference centre to opt out.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Opting out later. The opt-out link and preference centre are always available, so visitors can opt out or change an earlier choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • CCPA

    Opt-out

    California Consumer Privacy Act

    California, USA In force since January 2020

  • CPRA

    Opt-out

    California Privacy Rights Act

    California, USA In force since January 2023

  • CTDPA

    Opt-out

    Connecticut Data Privacy Act

    Connecticut, USA In force since July 2023, with major amendments from July 2026

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price