Applicability

What it requires

Applies to controllers that conduct business in Colorado or intentionally target Colorado residents and that either control or process the personal data of 100,000+ consumers during a calendar year, or derive revenue or receive a discount on the price of goods or services from the sale of personal data and process or control the personal data of 25,000+ consumers. Since July 1, 2025 (HB 24-1130), a controller that controls or processes any amount of biometric identifiers or biometric data is also covered, whatever the volume; one covered only on that basis must comply only as to the biometric data it collects and processes. Since October 1, 2025 (SB 24-041), the minors' provisions (§§ 6-1-1305.5, 6-1-1308.5, and 6-1-1309.5) and §§ 6-1-1310 to 6-1-1313 (liability, enforcement, preemption, and rules) apply to any controller that conducts business in Colorado or targets Colorado residents, with no volume threshold. Colorado sets no minimum-revenue threshold.

Statute text

(1) Except as specified in subsection (2) of this section: (a) This part 13, other than sections 6-1-1305.5, 6-1-1308.5, and 6-1-1309.5, applies to a controller that: (I) (A) Conducts business in Colorado or produces or delivers commercial products or services that are intentionally targeted to residents of Colorado; and (B) Satisfies one or both of the following thresholds: controls or processes the personal data of one hundred thousand consumers or more during a calendar year; or derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more; or (II) Controls or processes any amount of biometric identifiers or biometric data regardless of the amount of biometric identifiers or biometric data controlled or processed annually; [...] (b) Sections 6-1-1305.5, 6-1-1308.5, and 6-1-1309.5 to 6-1-1313 apply to a controller that conducts business in Colorado or delivers commercial products or services that are intentionally targeted to residents of Colorado.

Colorado Privacy Act, § 6-1-1304Read the full section from Colorado Attorney General