Colorado has a requirement that changes the equation for any site with users in the state.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CPA and cookies.

From July 1, 2024, if your site processes personal data for targeted advertising or sells personal data, it must automatically detect and honor the Universal Opt-Out Mechanism (UOM). This includes the Global Privacy Control (GPC) and other mechanisms recognized by the Colorado Department of Law.

This is not optional. It is not a recommended best practice. It is a legal obligation under the Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.), complemented by the Colorado Privacy Act Rules (4 CCR 904-3).

This article focuses exclusively on what the CPA and its regulations require from a Cookies Policy: what the document must contain, how consent and opt-out must work, and what the Universal Opt-Out Mechanism means for each tracker on your site.

The cookie banner is the visual interface. It is what the visitor sees when they access the site and where they make choices.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the consent notice itself.

C.R.S. § 6-1-1308(1)(a)(II) requires the privacy notice to describe the purposes for which each category of data is processed. The regulations (4 CCR 904-3, Rule 6.06) require specificity.

For cookies, each category needs a purpose description the consumer can actually understand.

What does not work: "cookies to improve your experience." That is not a purpose.

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is processed by our internal systems and is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for targeted advertising on other non-affiliated sites and applications. Include pixels from Meta Ads, Google Ads. Consumers may exercise opt-out through the link in our Privacy Policy or via Universal Opt-Out Mechanism."

The Policy must list tracker categories:

Necessary cookies: essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented.

Analytics cookies: depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, it may.

Advertising cookies: almost always constitute targeted advertising under the CPA, which defines it as ads based on data "obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications, or online services" (C.R.S. § 6-1-1303(25)(a)).

Functional cookies: remember preferences. Generally do not constitute targeted advertising or data sale.

Third-party cookies: fired by external services. Correct tag categorization is what makes it possible to document each one accurately.

The CPA defines targeted advertising (C.R.S. § 6-1-1303(25)(a)) as displaying an advertisement selected based on personal data obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications, or online services.

What does not constitute targeted advertising:

Advertising in response to a specific consumer request.

Advertisements based on activities within the controller's own websites or applications.

Advertisements based on the context of the current search query, website visit, or online application.

Processing personal data solely for measuring or reporting advertising performance, reach, or frequency.

The CPA defines sale (C.R.S. § 6-1-1303(23)(a)) as the exchange of personal data for monetary or other valuable consideration from a controller to a third party.

The second threshold criterion of the CPA already signals this breadth: it includes "receiving a discount on the price of goods or services" from the sale of data. Agreements where the controller exchanges data for indirect economic benefits may constitute a sale.

The notice must identify the categories of third parties receiving data via cookies (C.R.S. § 6-1-1308(1)(a)(V)), at a level of detail giving the consumer understanding of the type, business model of, or processing by those third parties (4 CCR 904-3, Rule 6.03(A)(1)(e)).

This means it is not enough to say "advertising partners." The notice should describe, for example: "digital advertising platforms that use the data for cross-context behavioral advertising," "data brokers," "analytics platforms that process browsing behavior data."

This is the most important CPA requirement for the cookies context. From July 1, 2024, a controller that processes personal data for targeted advertising or sells data must accept opt-outs via UOM (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret that signal as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The regulations (4 CCR 904-3, Rule 5.08(A)) detail:

After receiving a valid opt-out via UOM, the controller must continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again.

The controller cannot require the consumer to log in as a condition for recognizing the UOM.

The controller may display conspicuously when the opt-out signal has been honored (e.g., "Opt-Out Preference Signal Honored").

The Cookies Policy must describe how the UOM is processed and what happens when a consumer sends this signal.

The duty of data minimization (C.R.S. § 6-1-1308(3)) and the regulations (4 CCR 904-3, Rule 6.07) require data to be kept only for as long as necessary for the specified purpose.

For cookies: document how long each cookie category stays active on the device and how long collected data stays in the business's systems. Biometric data and stored photographs must be reviewed at least once a year to verify the storage is still necessary (4 CCR 904-3, Rule 6.07(B)(2)).

C.R.S. § 6-1-1303(5) defines consent as a clear, affirmative act that is freely given, specific, informed, and unambiguous.

The correct standard: non-essential cookies off by default. The user chooses what to enable.

What is not valid consent: accepting general terms with data processing descriptions mixed with unrelated information, hovering over or closing content, and any agreement through dark patterns.

Colorado's regulations have the most detailed description of dark patterns among all US state privacy laws (4 CCR 904-3, Rule 7.09). Prohibited:

Presenting consent choice options with unequal weight or focus ("accept" button larger, in a more prominent color, or more visible than "decline").

Emotionally manipulative language or visuals to steer choices (e.g., "Yes, I want to help endangered species" vs "No, I don't care about animals").

Silence or inaction interpreted as consent (closing a window is not consent).

Pre-selected default options.

A longer or more difficult path to exercise the more privacy-protective option than to accept.

Repeatedly interrupting the consumer experience to request consent after refusal.

Misleading language, double negatives, or confusing syntax in choice options.

The CPA defines "child" as an individual under 13 years of age (C.R.S. § 6-1-1303(4)). Data from known children is sensitive data and requires parental consent before processing (C.R.S. § 6-1-1308(7)).

The regulations (4 CCR 904-3, Rule 7.06) detail verifiable parental consent methods, including: signed forms returned by mail or fax, financial transaction with account holder notification, toll-free telephone call with trained staff, or videoconference.

If the site may have users under 13, the Cookies Policy must describe how cookies are blocked for this audience.

The regulations (4 CCR 904-3, Rule 6.04) require notifying consumers of material changes. For cookies, situations requiring an update:

Adding a new advertising pixel or third-party tracker.

New analytics tool.

New partner receiving behavioral data.

Change in the use of cookie data for new purposes.

Addition of a newly recognized UOM to the Colorado Department of Law's public list (which requires the site to begin recognizing it within 6 months).

Continuous data mapping is what keeps the cookie inventory synchronized with the document.

CPA violations are treated as deceptive trade practices by the Attorney General and District Attorneys of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

The 60-day cure period was repealed on January 1, 2025. From 2025 onward, the AG and DAs may act without a guaranteed prior correction period.

AdOpt's automatic scan identifies all active technologies, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-essential trackers before acceptance, automatically detects and honors the GPC and other UOMs, offers real choice options without dark patterns, and logs every interaction for 24 months.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.

Visible link in the footer and within the cookie banner.

Listing of cookie categories with a specific description of each.

Specific purpose for each category, without vague descriptions.

Indication of whether data is sold or used for targeted advertising (4 CCR 904-3, Rule 6.03(A)(1)(c)).

Categories of third parties receiving data, with detail on type/business model.

Clear and conspicuous opt-out method within and outside the notice (4 CCR 904-3, Rule 4.03(B)).

Universal Opt-Out Mechanism recognized: description of how GPC and other UOMs are processed (mandatory since July 2024).

Retention period for each cookie category.

Non-essential cookies disabled by default, without dark patterns (4 CCR 904-3, Rule 7.09).

Protection for children under 13 with tracker blocking without parental consent.

Date of last update of the document.

Accessible language, without legal jargon.

No cookie walls.

1. What is the Universal Opt-Out Mechanism and why is it mandatory in Colorado?
The UOM is a mechanism (like the GPC) that allows the consumer to automatically communicate their opt-out choice for targeted advertising and data sale to multiple controllers simultaneously. From July 2024, C.R.S. § 6-1-1306(1)(a)(IV)(B) made it mandatory for controllers processing data for targeted advertising or data sale to accept and honor these signals. Colorado was the first US state to require this by law.

2. How should I configure the site to recognize the GPC as a UOM?
The regulations (4 CCR 904-3, Rule 5.08) require that when a valid UOM signal is received, the controller must immediately cease processing for the indicated opt-out purposes. The controller cannot require login to recognize the signal, cannot collect data beyond what is strictly necessary to authenticate the consumer as a Colorado resident, and may display on screen when the signal has been honored. A consent management platform integrates this recognition automatically.

3. What happens if the consumer sends the GPC and the site continues tracking for advertising?
It is a direct violation of C.R.S. § 6-1-1306(1)(a)(IV)(B). The AG or District Attorney may investigate and, from 2025, act without a guaranteed cure period. The regulations (4 CCR 904-3, Rule 5.08(A)(2)) clarify that the controller must continue treating the browser and consumer as having exercised opt-out until the consumer voluntarily consents again.

4. Do analytics cookies require opt-out under the CPA?
It depends on how the data is used. If analytics data stays internal and is not sent to third parties for targeting on other sites, it generally does not constitute targeted advertising. But if the analytics tool sends data to the provider for use on other sites, it may. The CPA's criterion is "activities across nonaffiliated websites" (C.R.S. § 6-1-1303(25)(a)).

5. How does Colorado's dark pattern prohibition apply to cookie banners?
The regulations (4 CCR 904-3, Rule 7.09) are detailed: "accept" and "decline" buttons must have equal visual weight (size, color, position). The path to decline cannot be longer or more difficult. Pre-selected options are prohibited. Reappearing repeatedly after the consumer declines is prohibited. Cookie walls blocking content until acceptance may be prohibited if consent is not strictly necessary for the service.

Ready to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.