Colorado CPA and Cookies: All You Need to Know

João Bruno Soares

The Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.) has one of the most detailed sets of privacy notice requirements among all US state privacy laws.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This happens because Colorado went beyond the statute: the Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), a complete set of regulations that precisely specify what each element of the privacy notice must contain, how it must be presented, in what languages, and which changes require immediate update.

This article focuses exclusively on what the CPA and its regulations require from the Privacy Policy, based on the official text of both documents.

## What the CPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy.

C.R.S. § 6-1-1308(1) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear, and meaningful."

The regulations (4 CCR 904-3, Rule 6.02) expand this standard: the notice must give the consumer a meaningful understanding and accurate expectations of how their personal data will be processed. It must be clear, easily accessible, specific, and available in all languages the controller regularly uses to interact with consumers.

## What must be in the Privacy Policy under the CPA

### 1. Categories of personal data processed

The notice must list the categories of personal data collected or processed by the controller or a processor (C.R.S. § 6-1-1308(1)(a)(I)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(a)) require categories to be described at a sufficient level of detail for the consumer to understand the type of data. Examples of categories with adequate granularity: "contact information," "government-issued identification numbers," "payment information," "data from cookies," "data revealing religious affiliation," "medical data."

The notice must also specifically indicate whether sensitive data or children's data is processed.

### 2. The purposes for which the data is processed

The notice must explain what the data of each category is used for (C.R.S. § 6-1-1308(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 6.06) require the purpose to be described at a level of detail that gives the consumer a meaningful understanding of how the data is used. Vague purposes are not permitted. If data will be used for targeted advertising, profiling, or sale, this must be stated explicitly for each category.

### 3. How consumers exercise their rights and file appeals

The notice must describe how and where consumers can exercise the rights guaranteed by the CPA, including the controller's contact information and how to appeal a decision (C.R.S. § 6-1-1308(1)(a)(III)).

The regulations (4 CCR 904-3, Rule 6.03(A)(4)) detail what must be in the notice:

Instructions on how to use each available submission method.

Instructions on how an authorized agent may submit opt-outs on behalf of a consumer.

A clear and conspicuous method to exercise opt-out of targeted advertising and data sale.

The description of the commercially reasonable identity authentication process.

Effective July 2024: explanation of how requests via Universal Opt-Out Mechanism will be processed.

### 4. Categories of personal data shared with third parties

If the controller shares data with third parties, the notice must identify the categories of data shared (C.R.S. § 6-1-1308(1)(a)(IV)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(d)) also require the notice to indicate whether each category of data will be sold, used for targeted advertising, or for profiling with significant effects on the consumer.

### 5. Categories of third parties with whom data is shared

In addition to the categories of data, the notice must identify the categories of third parties that receive them (C.R.S. § 6-1-1308(1)(a)(V)).

The regulations (4 CCR 904-3, Rule 6.03(A)(1)(e)) require categories of third parties to be described at a level of detail that gives the consumer a meaningful understanding of the type, business model of, or processing conducted by those third parties. Examples: "analytics companies," "data brokers," "third-party advertisers," "payment processors," "lenders," "government agencies."

### 6. The date of last update

The regulations (4 CCR 904-3, Rule 6.03(A)(8)) require the notice to include the date it was last updated.

## The opt-out mechanism must be in the notice

C.R.S. § 6-1-1308(1)(b) requires that if the controller sells personal data or processes for targeted advertising, it must disclose this clearly and conspicuously, along with the method to exercise the opt-out.

The regulations (4 CCR 904-3, Rule 4.03(B)) detail: the opt-out method must appear in the privacy notice AND in a clear, conspicuous, and readily accessible location outside the notice. A direct link to the opt-out method is required.

From July 2024, the notice must also describe how requests via Universal Opt-Out Mechanism (including the GPC) will be processed.

## Sensitive data: additional requirements

If the controller processes sensitive data, the notice must reflect this explicitly.

Sensitive data under the CPA (C.R.S. § 6-1-1303(24)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life or sexual orientation, citizenship status, genetic or biometric data for identification, and known children's data.

The regulations (4 CCR 904-3, Rule 6.10) add an important nuance: inferences made by the controller that indicate these sensitive categories ("Sensitive Data Inferences") are also sensitive data and require consent to be processed, except in specific situations where they can be deleted within 24 hours.

If the controller uses this 24-hour inference exception, the notice must describe the inferences subject to this provision and the retention and deletion timeline.

## The duty of purpose specification

The CPA explicitly names the **duty of purpose specification** as an autonomous controller obligation (C.R.S. § 6-1-1308(2)): the controller must specify the express purposes for which personal data are collected and processed.

The regulations (4 CCR 904-3, Rule 6.06) detail what this means:

The purpose must be described at a level of detail that gives the consumer a meaningful understanding of how the data is used.

If data is collected for more than one purpose, each unrelated purpose must be specified separately.

It is not permitted to identify a broad purpose to justify numerous processing activities that are only remotely related.

It is not permitted to specify so many purposes that the purposes become unclear or uninformative.

## The duty to avoid secondary use

The CPA also names the **duty to avoid secondary use** (C.R.S. § 6-1-1308(4)): the controller must not process personal data for purposes not reasonably necessary or compatible with the specified purposes, except with consumer consent.

The regulations (4 CCR 904-3, Rule 6.08) detail: if the controller collected data before July 2023 and the processing purpose changes after that date in a way incompatible with the original, new consent must be obtained.

## The 24-month consent refresh requirement

This is a requirement exclusive to Colorado's regulations that does not exist in other US state privacy laws.

Under 4 CCR 904-3, Rule 7.08: when a consumer has not interacted with the controller in the **past 24 months**, the controller must **refresh consent** to:

Continue processing sensitive data.

Continue processing personal data for secondary purposes involving profiling with significant effects.

The exception is for cases where the consumer has permanent access and ability to update their opt-out preferences through a consumer-controlled interface.

The Privacy Policy must describe when and how this consent will be refreshed.

## Material changes: mandatory notification

The regulations (4 CCR 904-3, Rule 6.04) require the controller to notify consumers of material changes to the privacy notice, communicated in a manner by which the controller regularly interacts with consumers.

Material changes include: categories of personal data processed, processing purposes, the controller's identity, the act of sharing personal data with third parties, categories of third parties, and methods for exercising rights.

If a material change constitutes a secondary use, the controller must obtain consumer consent.

## Enforcement and penalties

CPA violations are treated as **deceptive trade practices** under the Colorado Consumer Protection Act (C.R.S. § 6-1-1311(1)(c)).

Enforcement is shared between the **Attorney General** and **District Attorneys** of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

Before 2025, there was a guaranteed 60-day cure period. From 2025 onward, the cure period is discretionary.

## How AdOpt supports CPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures that the Universal Opt-Out Mechanism is honored automatically and the consent mechanism works as described.

Every interaction is logged for 24 months as required by the regulations.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CPA

**Visible and accessible link** on all pages, using the word "privacy" (4 CCR 904-3, Rule 6.02(E)).

**Available in all languages** used by the controller to interact with consumers (4 CCR 904-3, Rule 3.02(A)(3)).

**Accessible for people with disabilities**, following WCAG 2.1 (4 CCR 904-3, Rule 3.02(A)(2)).

**Categories of personal data processed**, with sufficient granularity (C.R.S. § 6-1-1308(1)(a)(I)).

**Purpose for each category**, without vague descriptions (C.R.S. § 6-1-1308(1)(a)(II)).

**Whether data will be sold, used for targeted advertising, or profiling** (4 CCR 904-3, Rule 6.03(A)(1)(c)).

**How to exercise all rights** guaranteed by the CPA, with processes and timelines (C.R.S. § 6-1-1308(1)(a)(III)).

**Appeal process** described with 45+60 day deadlines.

**Categories of personal data shared with third parties** (C.R.S. § 6-1-1308(1)(a)(IV)).

**Categories of third parties** with detail on type/business model (C.R.S. § 6-1-1308(1)(a)(V)).

**Opt-out method** clearly within and outside the notice (C.R.S. § 6-1-1308(1)(b)).

**Universal Opt-Out Mechanism** processing explained (4 CCR 904-3, Rule 6.03(A)(4)(e)).

**Sensitive data and sensitive data inferences** identified with how consent is obtained.

**Consent refresh policy** after 24 months of consumer inactivity (4 CCR 904-3, Rule 7.08).

**Date of last update** (4 CCR 904-3, Rule 6.03(A)(8)).

**Controller contact information**.

**Authentication process** described.

## FAQ: CPA and Privacy Policy

**1. Does the CPA require a Colorado-specific privacy notice?**
No. The regulations (4 CCR 904-3, Rule 6.02(B)) confirm that the controller does not need a separate Colorado notice, as long as the existing notice meets all CPA requirements and makes clear that Colorado consumers have the rights provided by C.R.S. § 6-1-1306.

**2. In how many languages must the privacy notice be available?**
The notice must be available in all languages in which the controller ordinarily provides web pages, interfaces, contracts, and other information to consumers (4 CCR 904-3, Rule 3.02(A)(3)). Communications sent directly to the consumer must be in the language the consumer ordinarily uses to interact with the controller.

**3. What are "Sensitive Data Inferences" and how do they affect the Privacy Policy?**
They are inferences made by the controller based on personal data indicating racial or ethnic origin, religious beliefs, health condition, sex life or sexual orientation, or citizenship status (4 CCR 904-3, Rule 2.02). Like the underlying sensitive data, these inferences require consent to be processed. If the controller uses the 24-hour deletion exception, the Policy must describe the inferences subject to this provision and the retention timeline.

**4. What is the 24-month consent refresh requirement?**
The regulations (4 CCR 904-3, Rule 7.08) require that when a consumer has not interacted with the controller in the past 24 months, consent for processing sensitive data or for secondary purposes involving significant profiling effects must be refreshed. This requirement is exclusive to Colorado and does not exist in other US state privacy laws.

**5. What changed in CPA enforcement from 2025?**
Before 2025, C.R.S. § 6-1-1311(1)(d) guaranteed 60 days to cure before legal action. From January 1, 2025, this provision was repealed. The Attorney General and District Attorneys now have discretion to investigate and act without any obligation to grant a prior correction period.

[Ready to build a Privacy Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Colorado CPA compliance

Colorado CPA compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/colorado-cpa-cookies-policy/), which declares every tracker and its purpose; the [privacy portal](https://goadopt.io/en/blog/colorado-cpa-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.

## Go further

To put this into practice, read what a [consent management platform (CMP)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/) does.


Colorado CPA: Privacy Policy

Colorado has a requirement that changes the equation for any site with users in the state.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

From **July 1, 2024**, if your site processes personal data for targeted advertising or sells personal data, it must automatically detect and honor the **Universal Opt-Out Mechanism** (UOM). This includes the Global Privacy Control (GPC) and other mechanisms recognized by the Colorado Department of Law.

This is not optional. It is not a recommended best practice. It is a legal obligation under the Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.), complemented by the Colorado Privacy Act Rules (4 CCR 904-3).

This article focuses exclusively on what the CPA and its regulations require from a Cookies Policy: what the document must contain, how consent and opt-out must work, and what the Universal Opt-Out Mechanism means for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual interface. It is what the visitor sees when they access the site and where they make choices.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CPA specifically requires for cookies

### Specific purpose for each category

C.R.S. § 6-1-1308(1)(a)(II) requires the privacy notice to describe the purposes for which each category of data is processed. The regulations (4 CCR 904-3, Rule 6.06) require specificity.

For cookies, each category needs a purpose description the consumer can actually understand.

What does not work: "cookies to improve your experience." That is not a purpose.

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is processed by our internal systems and is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers that are shared with advertising platforms for targeted advertising on other non-affiliated sites and applications. Include pixels from Meta Ads, Google Ads. Consumers may exercise opt-out through the link in our Privacy Policy or via Universal Opt-Out Mechanism."

### Cookie categories present on the site

The Policy must list tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented.

**Analytics cookies:** depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, it may.

**Advertising cookies:** almost always constitute targeted advertising under the CPA, which defines it as ads based on data "obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications, or online services" (C.R.S. § 6-1-1303(25)(a)).

**Functional cookies:** remember preferences. Generally do not constitute targeted advertising or data sale.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes it possible to document each one accurately.

### Targeted advertising: the CPA's definition

The CPA defines targeted advertising (C.R.S. § 6-1-1303(25)(a)) as displaying an advertisement selected based on personal data obtained or inferred over time from the consumer's activities across **nonaffiliated websites, applications, or online services**.

What does not constitute targeted advertising:

Advertising in response to a specific consumer request.

Advertisements based on activities within the controller's own websites or applications.

Advertisements based on the context of the current search query, website visit, or online application.

Processing personal data solely for measuring or reporting advertising performance, reach, or frequency.

### Sale of personal data

The CPA defines sale (C.R.S. § 6-1-1303(23)(a)) as the exchange of personal data for monetary or other valuable consideration from a controller to a third party.

The second threshold criterion of the CPA already signals this breadth: it includes "receiving a discount on the price of goods or services" from the sale of data. Agreements where the controller exchanges data for indirect economic benefits may constitute a sale.

### Who receives data via cookies

The notice must identify the categories of third parties receiving data via cookies (C.R.S. § 6-1-1308(1)(a)(V)), at a level of detail giving the consumer understanding of the type, business model of, or processing by those third parties (4 CCR 904-3, Rule 6.03(A)(1)(e)).

This means it is not enough to say "advertising partners." The notice should describe, for example: "digital advertising platforms that use the data for cross-context behavioral advertising," "data brokers," "analytics platforms that process browsing behavior data."

### The Universal Opt-Out Mechanism and cookies

This is the most important CPA requirement for the cookies context. From **July 1, 2024**, a controller that processes personal data for targeted advertising or sells data **must** accept opt-outs via UOM (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret that signal as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The regulations (4 CCR 904-3, Rule 5.08(A)) detail:

After receiving a valid opt-out via UOM, the controller must continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again.

The controller cannot require the consumer to log in as a condition for recognizing the UOM.

The controller may display conspicuously when the opt-out signal has been honored (e.g., "Opt-Out Preference Signal Honored").

The Cookies Policy must describe how the UOM is processed and what happens when a consumer sends this signal.

### Retention period for each category

The duty of data minimization (C.R.S. § 6-1-1308(3)) and the regulations (4 CCR 904-3, Rule 6.07) require data to be kept only for as long as necessary for the specified purpose.

For cookies: document how long each cookie category stays active on the device and how long collected data stays in the business's systems. Biometric data and stored photographs must be reviewed at least once a year to verify the storage is still necessary (4 CCR 904-3, Rule 6.07(B)(2)).

## What constitutes valid consent for cookies under the CPA

C.R.S. § 6-1-1303(5) defines consent as a clear, affirmative act that is freely given, specific, informed, and unambiguous.

The correct standard: non-essential cookies off by default. The user chooses what to enable.

What is not valid consent: accepting general terms with data processing descriptions mixed with unrelated information, hovering over or closing content, and any agreement through dark patterns.

### Dark patterns: Colorado's detailed prohibition

Colorado's regulations have the most detailed description of dark patterns among all US state privacy laws (4 CCR 904-3, Rule 7.09). Prohibited:

Presenting consent choice options with unequal weight or focus ("accept" button larger, in a more prominent color, or more visible than "decline").

Emotionally manipulative language or visuals to steer choices (e.g., "Yes, I want to help endangered species" vs "No, I don't care about animals").

Silence or inaction interpreted as consent (closing a window is not consent).

Pre-selected default options.

A longer or more difficult path to exercise the more privacy-protective option than to accept.

Repeatedly interrupting the consumer experience to request consent after refusal.

Misleading language, double negatives, or confusing syntax in choice options.

## Protection for children's data via cookies

The CPA defines "child" as an individual under 13 years of age (C.R.S. § 6-1-1303(4)). Data from known children is sensitive data and requires parental consent before processing (C.R.S. § 6-1-1308(7)).

The regulations (4 CCR 904-3, Rule 7.06) detail verifiable parental consent methods, including: signed forms returned by mail or fax, financial transaction with account holder notification, toll-free telephone call with trained staff, or videoconference.

If the site may have users under 13, the Cookies Policy must describe how cookies are blocked for this audience.

## When to update the Cookies Policy

The regulations (4 CCR 904-3, Rule 6.04) require notifying consumers of material changes. For cookies, situations requiring an update:

Adding a new advertising pixel or third-party tracker.

New analytics tool.

New partner receiving behavioral data.

Change in the use of cookie data for new purposes.

Addition of a newly recognized UOM to the Colorado Department of Law's public list (which requires the site to begin recognizing it within 6 months).

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## Enforcement: AG and District Attorneys

CPA violations are treated as deceptive trade practices by the **Attorney General** and **District Attorneys** of Colorado. There is no private right of action (C.R.S. § 6-1-1310).

The 60-day cure period was repealed on January 1, 2025. From 2025 onward, the AG and DAs may act without a guaranteed prior correction period.

## How AdOpt helps with the Cookies Policy under the CPA

AdOpt's automatic scan identifies all active technologies, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, automatically detects and honors the GPC and other UOMs, offers real choice options without dark patterns, and logs every interaction for 24 months.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CPA

**Visible link** in the footer and within the cookie banner.

**Listing of cookie categories** with a specific description of each.

**Specific purpose for each category**, without vague descriptions.

**Indication of whether data is sold or used for targeted advertising** (4 CCR 904-3, Rule 6.03(A)(1)(c)).

**Categories of third parties** receiving data, with detail on type/business model.

**Clear and conspicuous opt-out method** within and outside the notice (4 CCR 904-3, Rule 4.03(B)).

**Universal Opt-Out Mechanism** recognized: description of how GPC and other UOMs are processed (mandatory since July 2024).

**Retention period** for each cookie category.

**Non-essential cookies disabled by default**, without dark patterns (4 CCR 904-3, Rule 7.09).

**Protection for children under 13** with tracker blocking without parental consent.

**Date of last update** of the document.

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: CPA and Cookies Policy

**1. What is the Universal Opt-Out Mechanism and why is it mandatory in Colorado?**
The UOM is a mechanism (like the GPC) that allows the consumer to automatically communicate their opt-out choice for targeted advertising and data sale to multiple controllers simultaneously. From July 2024, C.R.S. § 6-1-1306(1)(a)(IV)(B) made it mandatory for controllers processing data for targeted advertising or data sale to accept and honor these signals. Colorado was the first US state to require this by law.

**2. How should I configure the site to recognize the GPC as a UOM?**
The regulations (4 CCR 904-3, Rule 5.08) require that when a valid UOM signal is received, the controller must immediately cease processing for the indicated opt-out purposes. The controller cannot require login to recognize the signal, cannot collect data beyond what is strictly necessary to authenticate the consumer as a Colorado resident, and may display on screen when the signal has been honored. A consent management platform integrates this recognition automatically.

**3. What happens if the consumer sends the GPC and the site continues tracking for advertising?**
It is a direct violation of C.R.S. § 6-1-1306(1)(a)(IV)(B). The AG or District Attorney may investigate and, from 2025, act without a guaranteed cure period. The regulations (4 CCR 904-3, Rule 5.08(A)(2)) clarify that the controller must continue treating the browser and consumer as having exercised opt-out until the consumer voluntarily consents again.

**4. Do analytics cookies require opt-out under the CPA?**
It depends on how the data is used. If analytics data stays internal and is not sent to third parties for targeting on other sites, it generally does not constitute targeted advertising. But if the analytics tool sends data to the provider for use on other sites, it may. The CPA's criterion is "activities across nonaffiliated websites" (C.R.S. § 6-1-1303(25)(a)).

**5. How does Colorado's dark pattern prohibition apply to cookie banners?**
The regulations (4 CCR 904-3, Rule 7.09) are detailed: "accept" and "decline" buttons must have equal visual weight (size, color, position). The path to decline cannot be longer or more difficult. Pre-selected options are prohibited. Reappearing repeatedly after the consumer declines is prohibited. Cookie walls blocking content until acceptance may be prohibited if consent is not strictly necessary for the service.

[Ready to build a Cookies Policy for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Colorado CPA compliance

Colorado CPA compliance rests on documents that need to agree with each other: the [privacy policy](https://goadopt.io/en/blog/colorado-cpa-privacy-policy/), which explains what you do with the data; the [privacy portal](https://goadopt.io/en/blog/colorado-cpa-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.


Colorado CPA: Cookies Policy

The Colorado Privacy Act (CPA) has a set of rules for the Privacy Portal that goes beyond the statute. The Attorney General promulgated the Colorado Privacy Act Rules (4 CCR 904-3), which specify exactly how each aspect of the DSAR process must work, including the minimum content of each request record, the record-keeping deadline, and how to handle authorized agents.

This page covers one piece of the picture. For the full scope of the CPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CPA and cookies](https://goadopt.io/en/blog/colorado-cpa-and-cookies-all-you-need-to-know/).

This article covers all of it: what a DSAR is under the CPA, the five guaranteed rights, the law's specific deadlines, the Universal Opt-Out Mechanism, and what the regulations require from the process.

## What is a DSAR under the CPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CPA. It is any formal request from a Colorado consumer to exercise the rights the law grants over their own data.

Under C.R.S. § 6-1-1306(1), the consumer may submit a request at any time using the methods specified by the controller in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure is familiar. The CPA adds the Universal Opt-Out Mechanism as an alternative channel for exercising opt-out of targeted advertising and data sale.

## What are consumer rights under the CPA?

Under C.R.S. § 6-1-1306(1), Colorado residents have five rights:

### Right to opt-out

The consumer may refuse the processing of their personal data for three purposes (C.R.S. § 6-1-1306(1)(a)):

Targeted advertising.

Sale of personal data.

Profiling in furtherance of decisions with legal or similarly significant effects (access to financial or lending services, housing, insurance, education, criminal justice, employment, healthcare, or essential goods).

The consumer may also exercise the opt-out through an authorized agent, including via UOM (such as the GPC), when the controller can authenticate the consumer's identity and the agent's authority with commercially reasonable effort (C.R.S. § 6-1-1306(1)(a)(II)).

The regulations (4 CCR 904-3, Rule 4.03(A)(1)(b)) detail: if the opt-out is submitted online and the controller cannot identify the consumer to cease processing of connected offline data, it may request additional information. And if a consumer submitted multiple DSARs, the opt-out must be processed first.

### Right of access

The consumer may confirm whether the controller processes their data and access the personal data (C.R.S. § 6-1-1306(1)(b)).

The regulations (4 CCR 904-3, Rule 4.04(A)(1)) clarify that "specific pieces of personal data" include final profiling decisions, inferences, derivative data, marketing profiles, and any other personal data created by the controller linked to the consumer.

The response must be provided in a common, accessible electronic format, in the language the consumer uses to interact with the controller, without incomprehensible internal codes.

The controller does not need to disclose in response to an access request: government-issued identification numbers, financial account numbers, biometric data or biometric identifiers. But must inform the consumer that it holds these types of data (e.g., "We collect unique biometric data including fingerprint scan" without revealing the actual scan).

### Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature and purposes of processing (C.R.S. § 6-1-1306(1)(c)).

The regulations (4 CCR 904-3, Rule 4.05) detail:

The controller corrects in active systems but may delay for archive or backup systems until they are restored or accessed.

If the correction can be made by the consumer through account settings, the controller may provide instructions, provided the process is not unduly burdensome.

The controller may request documentation to verify data accuracy.

If the controller did not receive the data directly from the consumer and has no supporting documentation, the consumer's assertion of inaccuracy is sufficient to establish that the data is inaccurate.

### Right to deletion

The consumer may request deletion of personal data (C.R.S. § 6-1-1306(1)(d)).

The regulations (4 CCR 904-3, Rule 4.06) detail:

The controller permanently and completely erases from active systems, or de-identifies so it cannot reasonably be linked to the individual.

Also instructs processors to delete.

May delay for archive or backup systems until they are restored.

For data obtained from third parties (not directly from the consumer), may comply by retaining only the deletion request record and the minimum necessary to ensure the data remains deleted, or opting the consumer out of all processing.

If partial retention is justified by a legal exception, must inform the consumer of which categories were not deleted and which exception applies.

### Right to data portability

When exercising the right of access, the consumer may obtain data in a portable and, where technically feasible, readily usable format that allows transmission to another entity without hindrance (C.R.S. § 6-1-1306(1)(e)).

Portability may be exercised **no more than twice per calendar year**. This differs from other US state privacy laws that do not impose this limit on the right to portability.

The controller is not required to provide data in a manner that discloses trade secrets. But must provide as much data as possible in portable format without disclosing the secret.

## What are the response deadlines?

The CPA's deadlines have a specific structure.

**45 days** from receipt of the request to respond (C.R.S. § 6-1-1306(2)(a)).

The deadline may be extended by another **45 days** when reasonably necessary, considering complexity and number of requests, as long as the consumer is notified within the initial period with the reason.

For **appeals**: **45 days** to respond, extendable by another **60 days** in cases of complexity or large number of requests (C.R.S. § 6-1-1306(3)(b)).

The first request is free. For subsequent requests within the same 12-month period, the business may charge a fee calculated under C.R.S. § 24-72-205(5)(a).

## The appeal process with distinct deadlines

The CPA has a very specific appeal process (C.R.S. § 6-1-1306(3)):

The controller must establish an internal appeal process that is conspicuously available and as easy to use as the original request submission process.

The process must be actionable within a reasonable period after the consumer receives the denial notice.

The appeal response must include the decision and the written justification.

If the appeal is denied, the controller must **inform the consumer of the ability to contact the Attorney General** (C.R.S. § 6-1-1306(3)(c)).

## What should the request submission channel look like?

The regulations (4 CCR 904-3, Rule 4.02(B)) detail the requirements:

**Online-only businesses with a direct consumer relationship:** a single email address is sufficient.

**Other businesses:** two or more designated methods, and if the business maintains a website, application, or digital presence, one method must be through that digital presence (web form).

**Businesses that interact in person:** must consider an in-person method (printed form, tablet/computer portal, or telephone for a toll-free call).

The method must:

Consider how consumers normally interact with the controller.

Enable the consumer to submit the request at any time.

Use reasonable data security measures.

Be easy to execute, with a minimal number of steps.

Not require creating a new account (but may require using an existing password-protected account).

## Authentication: how to do it right

The regulations (4 CCR 904-3, Rule 4.08) are specific:

The controller must use a commercially reasonable method to authenticate each request. To determine what is reasonable, consider:

The right being exercised, the type, sensitivity, value, and volume of data involved.

The level of possible harm from improper access.

The cost of authentication to the controller.

The controller should avoid requesting additional personal data if it can authenticate using data it already has.

The controller cannot charge an authentication fee to the consumer (e.g., cannot require notarization without compensating the consumer for the cost).

If unable to authenticate with reasonable effort, the controller is not required to comply. But must inform the consumer that their identity could not be authenticated and how to remedy deficiencies.

## Mandatory documentation for 24 months

The regulations (4 CCR 904-3, Rule 6.11(A)) require records of all DSARs to be maintained for at least **24 months**. Each record must include at minimum:

The date of the request.

The type of request.

The date of the controller's response.

The nature of the response.

The basis for denial if the request was denied in whole or in part.

The existence and resolution of any appeal.

Records of DSARs already complied with must also be maintained for 24 months and made available to any new controller in a merger, acquisition, or other transaction where a third party assumes control of personal data.

## The Universal Opt-Out Mechanism in the Privacy Portal

The UOM (including the GPC) does not replace the Privacy Portal, but covers the opt-out for targeted advertising and data sale.

When the consumer sends a valid UOM signal, the controller must:

Cease processing for the indicated purposes as soon as feasibly possible, without undue delay (4 CCR 904-3, Rule 4.03(A)(1)).

Maintain a record of the opt-out (4 CCR 904-3, Rule 4.03(A)(2)).

Continue treating the browser, device, and consumer as having exercised opt-out until the consumer consents again (4 CCR 904-3, Rule 5.08(A)(2)).

If the consumer wants to opt out of profiling with significant effects, this still requires submission through the Privacy Portal, since the UOM covers only targeted advertising and data sale.

## Protection against discrimination

C.R.S. § 6-1-1308(1)(c)(II) prohibits the controller from, based solely on the exercise of a right and unrelated to feasibility or the value of a service, increasing the cost or decreasing the availability of the product or service.

The exception is loyalty programs, rewards, premium features, discounts, or club card programs (C.R.S. § 6-1-1308(1)(d)). The regulations (4 CCR 904-3, Rule 6.05) detail extensively the obligations related to loyalty programs.

## Enforcement: AG and District Attorneys

The CPA is enforced by the **Attorney General** and **District Attorneys** of Colorado (C.R.S. § 6-1-1311). There is no private right of action.

From January 1, 2025, the 60-day cure period was repealed. AG and DAs have discretion to act without a guaranteed prior correction period.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent and opt-out interaction with a timestamp and unique identifier, maintaining documentation for 24 months as required by the regulations.

The GPC and other UOMs are detected and honored automatically. When the consumer exercises opt-out via Portal or via UOM, the system updates the corresponding trackers. The auditable log serves as evidence for the AG or District Attorneys.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CPA

**Two or more submission methods** for non-online-only businesses, including a digital channel if the business has digital presence (4 CCR 904-3, Rule 4.02(B)(1)(b)).

**Email only** for online-only businesses with a direct consumer relationship (4 CCR 904-3, Rule 4.02(B)(1)(a)).

**Coverage of 5 rights**: opt-out, access, correction, deletion, portability.

**Portability limited to 2x per calendar year** (C.R.S. § 6-1-1306(1)(e)).

**Universal Opt-Out Mechanism** honored automatically from July 2024 (C.R.S. § 6-1-1306(1)(a)(IV)(B)).

**Conspicuously available appeal process** as easy as the original submission process.

**Deadlines**: 45 days for response (+45 ext.); 45 days for appeals (+60 ext.).

**Information to consumer** on how to contact the AG in case of denied appeal.

**Authentication** with commercially reasonable effort, no fee charged, no unnecessary data requested.

**Records maintained for 24 months** with the 6 mandatory fields (4 CCR 904-3, Rule 6.11(A)).

**Free first request**; second may be charged under C.R.S. § 24-72-205(5)(a).

**Consent refresh** configured for 24 months of consumer inactivity.

**Notification to processors** when a deletion or correction is fulfilled.

## Comparison: Privacy Portal deadlines under the CPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Opt-out, access, correction, deletion | 45 days | +45 days with notification |
| Portability (max 2x/year) | 45 days | +45 days with notification |
| Appeal of a decision | 45 days | +60 days with notification |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CPA and Privacy Portal

**1. Does the CPA require a dedicated Privacy Portal or is an email address sufficient?**
It depends on the type of business. Online-only businesses with a direct consumer relationship only need an email address (4 CCR 904-3, Rule 4.02(B)(1)(a)). Others need two or more methods, and a business with a website must offer a digital option (web form). A dedicated Privacy Portal is the most organized approach, but it is not the name the law requires.

**2. How does the twice-per-year limit on portability work?**
The right to portability under the CPA may be exercised no more than twice per calendar year (C.R.S. § 6-1-1306(1)(e)). This is a limit exclusive to the CPA among US state privacy laws. The right of access (without portable format) does not have this explicit limit in the statute, although the first request is free and subsequent ones may be charged.

**3. What must the controller do when a consumer has not interacted for 24 months?**
The regulations (4 CCR 904-3, Rule 7.08) require the controller to refresh consent for processing sensitive data and for secondary purposes involving profiling with significant effects, when the consumer has not interacted in the past 24 months. This means the Privacy Portal and consent management systems need to track the consumer's last interaction and trigger consent refresh flows.

**4. What happens after a denied appeal under the CPA?**
C.R.S. § 6-1-1306(3)(c) requires the controller to inform the consumer of the ability to contact the Attorney General. This differs from other laws that require specific instructions on how to contact the authority. The CPA is more open: the controller must communicate that this option exists. The consumer can then file a complaint with the AG or the District Attorney of the relevant jurisdiction.

**5. Does the CPA have specific obligations about data found during an access request that the controller cannot disclose?**
Yes. The regulations (4 CCR 904-3, Rule 4.04(D)) list categories of data the controller does not need to disclose in the access response: government-issued identification numbers, financial account numbers, health insurance or medical identification numbers, passwords, security questions, biometric data, and biometric identifiers. But the controller must inform the consumer that it holds these types of data, with sufficient particularity (e.g., "We collect unique biometric data including a fingerprint scan") without revealing the actual data.

[Ready to build a Privacy Portal for your site that complies with the Colorado CPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Colorado CPA compliance

Colorado CPA compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/colorado-cpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/colorado-cpa-privacy-policy/), which explains what you do with the data.

## Go further

To put this into practice, read what a [consent management platform (CMP)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/) does.


All posts

Colorado CPA and Cookies: All You Need to Know

Colorado CPA: Privacy Policy

Colorado CPA: Cookies Policy

Colorado CPA: DSAR Privacy Portal