The Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.) has one of the most detailed sets of privacy notice requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CPA and cookies.

This happens because Colorado went beyond the statute: the Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), a complete set of regulations that precisely specify what each element of the privacy notice must contain, how it must be presented, in what languages, and which changes require immediate update.

This article focuses exclusively on what the CPA and its regulations require from the Privacy Policy, based on the official text of both documents.

The law uses the term "privacy notice." In practice, it is the Privacy Policy.

C.R.S. § 6-1-1308(1) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

The regulations (4 CCR 904-3, Rule 6.02) expand this standard: the notice must give the consumer a meaningful understanding and accurate expectations of how their personal data will be processed. It must be clear, easily accessible, specific, and available in all languages the controller regularly uses to interact with consumers.

The notice must list the categories of personal data collected or processed by the controller or a processor (C.R.S. § 6-1-1308(1)(a)(I)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(a)) require categories to be described at a sufficient level of detail for the consumer to understand the type of data. Examples of categories with adequate granularity: "contact information," "government-issued identification numbers," "payment information," "data from cookies," "data revealing religious affiliation," "medical data."

The notice must also specifically indicate whether sensitive data or children's data is processed.

The notice must explain what the data of each category is used for (C.R.S. § 6-1-1308(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 6.06) require the purpose to be described at a level of detail that gives the consumer a meaningful understanding of how the data is used. Vague purposes are not permitted. If data will be used for targeted advertising, profiling, or sale, this must be stated explicitly for each category.

The notice must describe how and where consumers can exercise the rights guaranteed by the CPA, including the controller's contact information and how to appeal a decision (C.R.S. § 6-1-1308(1)(a)(III)).

The regulations (4 CCR 904-3, Rule 6.03(A)(4)) detail what must be in the notice:

Instructions on how to use each available submission method.

Instructions on how an authorized agent may submit opt-outs on behalf of a consumer.

A clear and conspicuous method to exercise opt-out of targeted advertising and data sale.

The description of the commercially reasonable identity authentication process.

Effective July 2024: explanation of how requests via Universal Opt-Out Mechanism will be processed.

If the controller shares data with third parties, the notice must identify the categories of data shared (C.R.S. § 6-1-1308(1)(a)(IV)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(d)) also require the notice to indicate whether each category of data will be sold, used for targeted advertising, or for profiling with significant effects on the consumer.

In addition to the categories of data, the notice must identify the categories of third parties that receive them (C.R.S. § 6-1-1308(1)(a)(V)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(e)) require categories of third parties to be described at a level of detail that gives the consumer a meaningful understanding of the type, business model of, or processing conducted by those third parties. Examples: "analytics companies," "data brokers," "third-party advertisers," "payment processors," "lenders," "government agencies."

The regulations (4 CCR 904-3, Rule 6.03(A)(8)) require the notice to include the date it was last updated.

C.R.S. § 6-1-1308(1)(b) requires that if the controller sells personal data or processes for targeted advertising, it must disclose this clearly and conspicuously, along with the method to exercise the opt-out.

The regulations (4 CCR 904-3, Rule 4.03(B)) detail: the opt-out method must appear in the privacy notice AND in a clear, conspicuous, and readily accessible location outside the notice. A direct link to the opt-out method is required.

From July 2024, the notice must also describe how requests via Universal Opt-Out Mechanism (including the GPC) will be processed.

If the controller processes sensitive data, the notice must reflect this explicitly.

Sensitive data under the CPA (C.R.S. § 6-1-1303(24)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life or sexual orientation, citizenship status, genetic or biometric data for identification, and known children's data.

The regulations (4 CCR 904-3, Rule 6.10) add an important nuance: inferences made by the controller that indicate these sensitive categories ("Sensitive Data Inferences") are also sensitive data and require consent to be processed, except in specific situations where they can be deleted within 24 hours.

If the controller uses this 24-hour inference exception, the notice must describe the inferences subject to this provision and the retention and deletion timeline.

The CPA explicitly names the duty of purpose specification as an autonomous controller obligation (C.R.S. § 6-1-1308(2)): the controller must specify the express purposes for which personal data are collected and processed.

The regulations (4 CCR 904-3, Rule 6.06) detail what this means:

The purpose must be described at a level of detail that gives the consumer a meaningful understanding of how the data is used.

If data is collected for more than one purpose, each unrelated purpose must be specified separately.

It is not permitted to identify a broad purpose to justify numerous processing activities that are only remotely related.

It is not permitted to specify so many purposes that the purposes become unclear or uninformative.

The CPA also names the duty to avoid secondary use (C.R.S. § 6-1-1308(4)): the controller must not process personal data for purposes not reasonably necessary or compatible with the specified purposes, except with consumer consent.

The regulations (4 CCR 904-3, Rule 6.08) detail: if the controller collected data before July 2023 and the processing purpose changes after that date in a way incompatible with the original, new consent must be obtained.

This is a requirement exclusive to Colorado's regulations that does not exist in other US state privacy laws.

Under 4 CCR 904-3, Rule 7.08: when a consumer has not interacted with the controller in the past 24 months, the controller must refresh consent to:

Continue processing sensitive data.

Continue processing personal data for secondary purposes involving profiling with significant effects.

The exception is for cases where the consumer has permanent access and ability to update their opt-out preferences through a consumer-controlled interface.

The Privacy Policy must describe when and how this consent will be refreshed.

The regulations (4 CCR 904-3, Rule 6.04) require the controller to notify consumers of material changes to the privacy notice, communicated in a manner by which the controller regularly interacts with consumers.

Material changes include: categories of personal data processed, processing purposes, the controller's identity, the act of sharing personal data with third parties, categories of third parties, and methods for exercising rights.

If a material change constitutes a secondary use, the controller must obtain consumer consent.

CPA violations are treated as deceptive trade practices under the Colorado Consumer Protection Act (C.R.S. § 6-1-1311(1)(c)).

Enforcement is shared between the Attorney General and District Attorneys of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

Before 2025, there was a guaranteed 60-day cure period. From 2025 onward, the cure period is discretionary.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The consent management platform ensures that the Universal Opt-Out Mechanism is honored automatically and the consent mechanism works as described.

Every interaction is logged for 24 months as required by the regulations.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.

Visible and accessible link on all pages, using the word "privacy" (4 CCR 904-3, Rule 6.02(E)).

Available in all languages used by the controller to interact with consumers (4 CCR 904-3, Rule 3.02(A)(3)).

Accessible for people with disabilities, following WCAG 2.1 (4 CCR 904-3, Rule 3.02(A)(2)).

Categories of personal data processed, with sufficient granularity (C.R.S. § 6-1-1308(1)(a)(I)).

Purpose for each category, without vague descriptions (C.R.S. § 6-1-1308(1)(a)(II)).

Whether data will be sold, used for targeted advertising, or profiling (4 CCR 904-3, Rule 6.03(A)(1)(c)).

How to exercise all rights guaranteed by the CPA, with processes and timelines (C.R.S. § 6-1-1308(1)(a)(III)).

Appeal process described with 45+60 day deadlines.

Categories of personal data shared with third parties (C.R.S. § 6-1-1308(1)(a)(IV)).

Categories of third parties with detail on type/business model (C.R.S. § 6-1-1308(1)(a)(V)).

Opt-out method clearly within and outside the notice (C.R.S. § 6-1-1308(1)(b)).

Universal Opt-Out Mechanism processing explained (4 CCR 904-3, Rule 6.03(A)(4)(e)).

Sensitive data and sensitive data inferences identified with how consent is obtained.

Consent refresh policy after 24 months of consumer inactivity (4 CCR 904-3, Rule 7.08).

Date of last update (4 CCR 904-3, Rule 6.03(A)(8)).

Controller contact information.

Authentication process described.

1. Does the CPA require a Colorado-specific privacy notice?
No. The regulations (4 CCR 904-3, Rule 6.02(B)) confirm that the controller does not need a separate Colorado notice, as long as the existing notice meets all CPA requirements and makes clear that Colorado consumers have the rights provided by C.R.S. § 6-1-1306.

2. In how many languages must the privacy notice be available?
The notice must be available in all languages in which the controller ordinarily provides web pages, interfaces, contracts, and other information to consumers (4 CCR 904-3, Rule 3.02(A)(3)). Communications sent directly to the consumer must be in the language the consumer ordinarily uses to interact with the controller.

3. What are "Sensitive Data Inferences" and how do they affect the Privacy Policy?
They are inferences made by the controller based on personal data indicating racial or ethnic origin, religious beliefs, health condition, sex life or sexual orientation, or citizenship status (4 CCR 904-3, Rule 2.02). Like the underlying sensitive data, these inferences require consent to be processed. If the controller uses the 24-hour deletion exception, the Policy must describe the inferences subject to this provision and the retention timeline.

4. What is the 24-month consent refresh requirement?
The regulations (4 CCR 904-3, Rule 7.08) require that when a consumer has not interacted with the controller in the past 24 months, consent for processing sensitive data or for secondary purposes involving significant profiling effects must be refreshed. This requirement is exclusive to Colorado and does not exist in other US state privacy laws.

5. What changed in CPA enforcement from 2025?
Before 2025, C.R.S. § 6-1-1311(1)(d) guaranteed 60 days to cure before legal action. From January 1, 2025, this provision was repealed. The Attorney General and District Attorneys now have discretion to investigate and act without any obligation to grant a prior correction period.

Ready to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.