Governance, risk & compliance

Colorado Privacy Act (CPA) C.R.S. 6-1-1301 to 6-1-1314; in force 1 July 2023

The Colorado Privacy Act is Part 13 of Article 1 of Title 6 of the Colorado Revised Statutes (SB21-190, signed 7 July 2021, in force 1 July 2023).

It applies to controllers that do business in Colorado or target its residents and handle the personal data of 100,000 or more consumers a year, or 25,000 or more while earning revenue or discounts from selling personal data. Nonprofits are covered.

Consumers can access, correct and delete their data, take a portable copy, and opt out of targeted advertising, sale and certain profiling. Universal opt-out mechanisms have been mandatory since 1 July 2024.

Sensitive data needs opt-in consent, and controllers must run data protection assessments for risky processing. Two amendments matter: HB24-1130 added biometric rules that apply at any volume (1 July 2025), and SB24-041 added a duty of care, consent rules and assessments for minors under 18 that apply with no threshold (1 October 2025).

The general 60-day cure period ended on 1 January 2025; for the minors sections a cure notice is still required until 31 December 2026. The Attorney General and district attorneys enforce, and there is no private right of action.

Read from the signed session laws on leg. colorado.

gov and the AG page. The AG rules (4 CCR 904-3), the 2025 minors rulemaking outcome, the penalty amount, and any 2026 amendment were not read, and Colorado’s separate artificial intelligence statute is not part of this framework.

General information, not legal advice.

Assessment tiers & levels Lavawall supports

Lavawall assesses Colorado Privacy Act (CPA) at every level below, so you can start where you are and step up as your program matures.

How Lavawall® helps you get to Colorado Privacy Act (CPA) compliance

Most of Colorado Privacy Act (CPA) comes down to technical controls you have to run and prove: keeping systems patched, hardening configuration, detecting breaches early, backing up what matters, controlling access, and keeping evidence that all of it actually happened. Lavawall® runs those controls across Windows, macOS, Linux, and Microsoft 365 / Google Workspace from one console, maps them to Colorado Privacy Act (CPA), and tracks your posture continuously instead of once a year at audit time.

• Assess your current state against Colorado Privacy Act (CPA) in the Lavawall GRC module, with the questionnaire and control set built in.
• Remediate the gaps with the same platform — automated patching, configuration fixes, backups, and access review — not a separate project.
• Evidence everything with timestamped, exportable records auditors, insurers, and clients accept.

Related

Lavawall® supports Colorado Privacy Act (CPA) as part of a built-in catalogue of compliance frameworks. Framework requirements are summarized for planning purposes; always confirm the current official text before certifying.