Colorado Privacy Act (CPA)
A practical compliance guide for website owners. Learn what Colorado's privacy law requires and how to implement it on your site.
Who Must Comply
Controls/processes personal data of 100K+ Colorado residents, OR controls/processes data of 25K+ residents and derives revenue from selling personal data
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Required |
| Universal opt-out mechanism | Required |
| Sensitive data opt-in consent | Required |
Checked against the CPA on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The CPA requires the following links or notices to be visible on your website:
- 1Your Privacy Choices
- 2Privacy Policy
Enforcement & Penalties
Key Things to Know
The Colorado Privacy Act (CPA) has applied in Colorado since July 1, 2023.
Who it covers: Controls/processes personal data of 100K+ Colorado residents, OR controls/processes data of 25K+ residents and derives revenue from selling personal data.
Colorado publishes an official list of the universal opt-out mechanisms a business must recognise, so what counts is a matter of public record rather than interpretation.
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. CPA expects the choice to be reachable from your site under the heading “Your Privacy Choices”, and you may not degrade the service of someone who exercises it.
Global Privacy Control: CPA requires you to honour a universal opt-out mechanism sent by the visitor’s browser. A GPC signal has to be treated as the opt-out itself — not as a request to show someone a banner — and it applies to that browser without any further action from the person.
Cookie banner: CPA is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Recently amended. CPA changed on October 1, 2025. The summary above reflects the amended law.
Enforcement: Enforced under Colorado Consumer Protection Act — penalties vary. No specific per-violation amount. Enforced by the Colorado Attorney General.
How to Configure LegalBanner for CPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Colorado's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a CPA-compliant privacy policy.
Set up CPA compliance in 5 minutes
LegalBanner handles Colorado privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
What is Colorado's Universal Opt-Out Mechanism (UOOM) requirement?
As of July 2024, Colorado requires businesses to honor Universal Opt-Out Mechanisms (UOOM) such as Global Privacy Control (GPC). This means your website must detect and automatically respect GPC browser signals as opt-out requests for targeted advertising and sale of personal data.
Does Colorado require a cookie consent banner?
Colorado does not require opt-in cookie consent. However, you must provide clear opt-out mechanisms for targeted advertising and data sale, and honor universal opt-out signals like GPC. A cookie preference center with opt-out controls is strongly recommended.
Is GPC required in Colorado?
Yes. As of July 2024, Colorado requires businesses to honor GPC signals as a valid universal opt-out mechanism. LegalBanner automatically detects and processes GPC signals for Colorado compliance.
What is the difference between Colorado and California privacy laws?
Both require honoring GPC signals. Colorado uses 'Universal Opt-Out Mechanism' terminology and has specific AG rules defining recognized mechanisms. California uses 'opt-out preference signal' language. Both have similar scope but different enforcement structures.
What are the penalties for CPA violations?
The Colorado AG enforces the CPA under the Colorado Consumer Protection Act. There is no specific per-violation penalty amount — penalties are determined by the court. There is a 60-day cure period (sunset January 2025).