CPA § 6-1-1311
Enforcement and Penalties
Reference only. The Privisy audit does not test this section.
- Source
- Statute
- In force from
- October 1, 2025
- Last reviewed
- September 2026
- Framework
- CPA
What it requires
Grants the Colorado Attorney General and district attorneys exclusive authority to enforce the Act; there is no private right of action. Violations are deceptive trade practices under the Colorado Consumer Protection Act, carrying civil penalties of up to $20,000 per violation. The general 60-day right to cure (former subsection (1)(d)(I)) was repealed effective January 1, 2025, so for most violations the Attorney General may seek penalties without first offering a cure. For the minors' provisions added by SB 24-041 (§§ 6-1-1305.5, 6-1-1308.5, and 6-1-1309.5), however, subsection (1)(d)(II), in force since October 1, 2025, still requires a notice of violation and 60 days to cure, if a cure is deemed possible, before any enforcement action; that requirement is repealed effective December 31, 2026.
Statute text
(1) (a) Notwithstanding any other provision of this article 1, the attorney general and district attorneys have exclusive authority to enforce this part 13 by bringing an action in the name of the state or as parens patriae on behalf of persons residing in the state to enforce this part 13 as provided in this article 1, including seeking an injunction to enjoin a violation of this part 13. (b) Notwithstanding any other provision of this article 1, nothing in this part 13 shall be construed as providing the basis for, or being subject to, a private right of action for violations of this part 13 or any other law. (c) For purposes only of enforcement of this part 13 by the attorney general or a district attorney, a violation of this part 13 is a deceptive trade practice. (d) (I) Repealed. (II) Prior to any enforcement action pursuant to subsection (1)(a) of this section to enforce section 6-1-1305.5, 6-1-1308.5, or 6-1-1309.5, the attorney general or district attorney must issue a notice of violation to the controller if a cure is deemed possible. If the controller fails to cure the violation within sixty days after receipt of the notice of violation, an action may be brought pursuant to this section. This subsection (1)(d)(II) is repealed, effective December 31, 2026.
Colorado Privacy Act, § 6-1-1311Read the full section from Colorado Attorney General
This page is for information only and is not legal advice. The excerpt is reproduced from official public sources and was checked against them on the last-reviewed date above. Laws change: check the authoritative source and consult a licensed attorney for compliance guidance.