For three years, the honest answer to "has Colorado penalized anyone under its privacy law?" was no. That changed on October 29, when Attorney General Phil Weiser's office described the 36-state General Motors settlement as the first in Colorado to resolve allegations under the Colorado Privacy Act. If your site gets Colorado traffic, the law you've been treating as theoretical now has a dollar figure attached.
Where Enforcement Stands
The Colorado Privacy Act took effect on July 1, 2023. That same month the Attorney General's office sent letters to businesses saying it would enforce the law, and it framed that first round as education: mostly reminders about consent for sensitive data and the right to opt out of targeted advertising.
Two later dates did more to change the risk. Since July 1, 2024, controllers have had to honor opt-outs sent through a universal opt-out mechanism, and Global Privacy Control is on the Attorney General's list of recognized ones. Then, on January 1, 2025, the general 60-day right to cure expired. Under section 6-1-1311, the state can now pursue most violations without sending a warning first; a narrower cure for the minors' data provisions lasts only until December 31, 2026.
On September 9, 2025, Colorado joined CalPrivacy and the attorneys general of California and Connecticut in a joint investigative sweep, contacting businesses that may not be processing GPC opt-outs and asking them to comply. As of this writing, we're not aware of a public Colorado case that came out of it.
So the first settlement arrived from a different direction. The GM case is about driving and location data sold to brokers and insurers, not a website, and Colorado expects roughly $7.2 million of the $220 million total. Still, it shows the office will use the Act. Violations count as deceptive trade practices carrying up to $20,000 each, and only the Attorney General and district attorneys can bring them. Nobody can sue you privately under this law.
What Website Owners Should Do
Check whether you're covered before anything else. Colorado has no revenue threshold; it counts people. The Act reaches a business that handles the personal data of 100,000 or more Colorado consumers in a year, or 25,000 if it earns revenue from selling data, which means a company too small for California's law can still be in scope here.
If you are covered, test what your site does when a Colorado visitor's browser sends GPC. Targeted advertising tags should stop for that visitor, and a site that ignores the signal is what the three-state sweep went looking for.
Review any sensitive data you collect, precise location included, because Colorado wants opt-in consent before you process it. And don't plan around a cure letter. That option is gone.
Where Privisy Fits
Privisy is built around California's rules, but the signal is the same one in both states. The free GPC check loads your page with GPC switched on and reports how your site responds to it. It won't tell you whether Colorado's thresholds apply to you, and it doesn't see what vendors do with data after it leaves the browser; that part stays with you and counsel.
Check Your Site's GPC Response
See how your site responds when a visitor's browser sends the GPC signal.
Check GPC on your site