Colorado Privacy Act Compliance with ConsentX

The Colorado Privacy Act (CPA) is Colorado's comprehensive consumer privacy law. It gives Colorado consumers rights over their personal data and establishes obligations for organizations that control or process that data.

The CPA generally applies to organizations conducting business in Colorado or targeting Colorado residents that meet the Act's applicable thresholds for controlling or processing personal data. Certain entities, data and activities are exempt.

Colorado consumers have rights including access to their personal data, correction of inaccurate personal data, deletion of personal data, data portability, opting out of the sale of personal data, opting out of targeted advertising and opting out of certain profiling activities. Consumers can exercise these rights subject to applicable conditions and exceptions.

The CPA requires consent for certain processing activities, particularly the processing of sensitive data. Not all processing requires consent, so organizations should determine the appropriate legal basis and applicable requirements for each processing activity.

Sensitive data includes certain categories of personal data such as information revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status, certain genetic or biometric data and certain children's data. Colorado's privacy framework has also been amended to address additional categories, including precise geolocation data.

A Universal Opt-Out Mechanism (UOOM) allows consumers to communicate certain privacy choices across multiple businesses without submitting individual opt-out requests to each organization. Colorado requires covered organizations to honor applicable UOOM signals for certain opt-out rights.

Yes. Global Privacy Control (GPC) is currently recognized by the Colorado Department of Law as a valid Universal Opt-Out Mechanism. Covered organizations must honor GPC for applicable opt-out rights, including opting out of the sale of personal data and use of personal data for targeted advertising.

Yes. Colorado consumers have the right to opt out of the processing of their personal data for targeted advertising.

Yes. The CPA provides consumers with a right to opt out of certain profiling activities, particularly profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

The CPA regulates the processing of personal data rather than cookies specifically. Where cookies, trackers or similar technologies collect or process information that qualifies as personal data, organizations should evaluate the applicable CPA requirements and implement appropriate privacy controls.

Yes. Controllers must conduct data protection assessments for certain processing activities that present a heightened risk of harm to consumers. These can include processing involving targeted advertising, profiling, sale of personal data and sensitive data.

A covered organization generally must respond to a consumer request within 45 days. This period may be extended by an additional 45 days when reasonably necessary, provided the consumer is informed of the extension and the reasons for it.

ConsentX provides technology that can support important Colorado Privacy Act operations, including consent management, sensitive-data consent, consumer opt-outs, GPC support, tracker discovery, prior-script blocking, consumer-rights workflows and privacy evidence. However, ConsentX alone does not guarantee CPA compliance. Organizations must assess their complete data-processing activities, privacy notices, security controls, contracts, data protection assessments and other applicable legal obligations.