← All articles

Compliance

Does the Colorado Privacy Act apply to your website? A 2026 checklist for Denver small businesses

Most of what has been written about the Colorado Privacy Act was written in 2021 for large companies. Since then the law has picked up three amendments, two of which apply no matter how small you are, and the Attorney General now expects sites to honor a browser privacy signal automatically. Here is how to tell whether the law reaches your site, and what to change in the build if it does.

12 min read · By Zach Wennstedt · Published October 22, 2026

What is the Colorado Privacy Act, in one paragraph?

Governor Polis signed Senate Bill 21-190 on July 7, 2021, creating the Colorado Privacy Act (CPA). It took effect July 1, 2023 and sits inside the Colorado Consumer Protection Act. It gives Colorado residents the right to know what a company collects, to see it, correct it, delete it and take a portable copy, and to opt out of the sale of their data, of targeted advertising, and of certain kinds of profiling. It puts duties on covered companies: be transparent, collect only what you need, do not reuse data for surprise purposes, secure it, answer requests, run data protection assessments for risky processing, and get consent before using sensitive data. The Attorney General’s rules sit at 4 CCR 904-3.

Does the CPA apply to my small business website?

Size in dollars does not decide it. The Attorney General’s FAQ says the law applies to entities, including nonprofits, that conduct business in Colorado or deliver commercial products or services targeted to Colorado residents, and either:

• control or process the personal data of 100,000 or more Colorado consumers in a calendar year (the statute’s wording, which the AG quotes), or
• derive revenue or receive discounts in exchange for the sale of personal data of 25,000 or more individuals.

Three definitions do most of the work, and all three come from the same AG guidance:

• “Consumer” means a Colorado resident acting in an individual or household context. The 100,000 is Colorado residents, not everyone in the United States. People acting as employees, job applicants or in a business-to-business context do not count.
• “Personal data” is anything linked or reasonably linkable to a consumer. That is broader than names and emails. It does not include information made public by a government or by the person.
• There is no revenue floor. A five-person company with a very busy website and an ad-tech setup can be covered; a $40 million contractor with 3,000 customers a year may not be.

Some entities are excluded outright: financial institutions subject to the Gramm-Leach-Bliley Act, air carriers, and national securities associations. Data handled under certain federal laws, such as HIPAA protected health information and Fair Credit Reporting Act data, is excluded too. The full list is in C.R.S. 6-1-1304.

Where small businesses get tripped up is the website itself. Analytics, advertising pixels and embedded tools can collect identifiers for every visitor. Whether a given visitor’s cookie ID counts toward 100,000 depends on whether it is reasonably linkable to a person, which is a legal judgment we will not make for you. What we can say as builders is that you should know which tags on your site collect what, and that you can usually collect far less without losing anything you use.

Which parts of the law apply no matter how small you are?

Two amendments passed in 2024 reach past the thresholds.

Minors’ data, SB24-041, effective October 1, 2025. According to the General Assembly’s summary, it applies to any controller doing business in Colorado “regardless of the volume of or amount of revenue derived from that activity.” If you offer an online service, product or feature to someone you actually know, or willfully disregard, is under 18, you must use reasonable care to avoid a heightened risk of harm, run a data protection assessment where that risk exists, and, without consent, avoid targeted advertising to them, selling their data, unnecessary geolocation collection, and design features meant to stretch their time on the service. The law does not require age verification. For most Denver service businesses this means one practical thing: if you run a youth sports signup, a tutoring portal or a camp registration page, treat it as covered.

Biometric data, HB24-1130, effective July 1, 2025. The bill summary requires a controller that collects biometric identifiers to adopt a public written policy with a retention schedule, an incident-response protocol and deletion deadlines, and to give notice and get consent before collecting. Law firm analyses, such as Paul Hastings’, read it as applying even when the organization does not otherwise meet the CPA’s thresholds. If your gym uses fingerprint check-in or your clinic uses face-match identity verification, this one is yours.

A third 2025 change matters to covered businesses: SB25-276, signed May 23, 2025, bars selling a consumer’s sensitive data without consent and revises how precise geolocation data is defined.

What are the key dates?

1. July 7, 2021SB21-190 signed, creating the CPA.
2. July 1, 2023CPA takes effect; the AG begins enforcement on July 12, 2023, starting with educational letters.
3. July 1, 2024Covered controllers must honor universal opt-out signals; privacy notices must explain how those opt-outs are processed.
4. January 1, 2025The mandatory 60-day cure period ends. The AG or a district attorney can now act without first offering a chance to fix.
5. May 23, 2025SB25-276 signed: no selling sensitive data without consent.
6. July 1, 2025Biometric amendments (HB24-1130) take effect.
7. October 1, 2025Minors’ data amendments (SB24-041) take effect, with no volume threshold.

What is Global Privacy Control, and does my site have to honor it?

Global Privacy Control (GPC) is a signal a browser or extension sends with every request to say “do not sell or share my data for targeted ads.” The Colorado Department of Law keeps the official list of recognized universal opt-out mechanisms, and its opt-out page says GPC was the first recognized and is currently the only one it considers valid. If the CPA applies to you, you have had to honor it since July 1, 2024, and your privacy notice must say how you do.

On the technical side, the GPC specification defines two things a site can read: an HTTP request header, Sec-GPC: 1, and a read-only browser property, navigator.globalPrivacyControl, which is true when the header would be sent. Honoring it means your advertising tags do not fire for targeted advertising when it is on. A minimal pattern for a static site:

<script>
  // Load ad/retargeting tags only when the visitor has not sent GPC.
  if (navigator.globalPrivacyControl !== true) {
    var s = document.createElement('script');
    s.src = '/js/ads-tags.js';   // your pixel loader
    s.defer = true;
    document.head.appendChild(s);
  }
</script>

Tag managers and consent platforms can do the same with a built-in GPC trigger; the point is to test it. Turn the signal on in a browser or extension that supports it, reload your pages, and confirm in the network panel that your ad pixels stay silent.

Why do customers care about this at all?

Because most of them feel they have lost track of their data. Pew Research Center surveyed 5,101 U.S. adults in May 2023:

Share of U.S. adults. Survey of 5,101 adults, May 15 to 21, 2023.

Pew Research Center 2023 data privacy survey results

Say they have little or no control over what companies do with their data	73%
Say they understand little or nothing about what companies do with their data	67%
Say they frequently click “agree” without reading privacy policies	56%
Have little or no trust companies will use AI responsibly (of those who heard of AI)	70%

Source: Pew Research Center, “How Americans View Data Privacy,” October 18, 2023. The share who understand little to nothing about company data use rose from 59% in 2019.

That is the business case, separate from the legal one. A short, plain privacy notice, a contact form that asks only for what you need, and no surprise tracking are trust signals a visitor can see.

What should the website itself change?

These are the build decisions we make on every site, covered or not. For a business inside the CPA they are the floor; for everyone else they are cheap insurance and better design.

1. Inventory every tagList each script on the site, what it collects and where it sends it. Remove the ones nobody looks at, including tags from vendors you stopped paying long ago.
2. A privacy notice people can readThe AG’s rules require plain, straightforward language, readable on phones, in the languages the business normally uses. Say what you collect, why, who you share it with, how to exercise each right, and, if covered, how you process GPC.
3. Honor GPC in codeUse the pattern above or your consent tool’s GPC trigger, then test it.
4. Forms that ask for lessData minimization is a legal duty for covered companies and a conversion win for everyone. If you do not use date of birth, do not ask for it.
5. Consent that is realThe AG’s FAQ is direct: accepting broad terms of service, hovering, or agreement obtained through deceptive page design is not consent. No pre-checked boxes, no “Accept” in bright color next to a gray “settings” link for sensitive data.
6. Sensitive-data pages get extra careHealth conditions, race or ethnic origin, religious beliefs, sexual orientation, citizenship status, and any data about a child under 13 count as sensitive data under the CPA. Keep those forms off third-party scripts entirely, and get consent first.
7. A request path that worksCovered controllers must answer rights requests within 45 days, extendable once by 45 more with notice. A simple, monitored request form and an email address beat a PDF nobody reads.
8. Security basicsHTTPS everywhere, form submissions that do not land in an unmonitored inbox forever, and access limited to people who need it.

Our small business website checklist covers the rest of a healthy build, and our own privacy notice is an example of the plain-language approach. If a redesign is on the table, it is the right moment to strip out old tags; our redesign process includes that audit.

What happens if a covered business gets it wrong?

Only the Colorado Attorney General and district attorneys can enforce the CPA; the AG’s FAQ says individuals cannot sue under it. Violations are treated under the Colorado Consumer Protection Act, and law firm summaries such as Baker Donelson’s Colorado guide put the civil penalty at up to $20,000 per violation, and up to $50,000 where the victim is over 60. The mandatory 60-day chance to cure ended January 1, 2025. Most enforcement so far has begun with letters; the AG published examples of the “notice of application” letters it began sending in July 2023 on the same page.

Is the CPA the same as California’s law or the EU’s GDPR?

No, and copying a template from either is a common mistake. The CPA has no revenue threshold, unlike California’s. It uses an opt-out model for targeted advertising and sales rather than the EU model of consent before most cookies, but it does require opt-in consent for sensitive data and for using data in new ways. If you serve customers in several states, map each law’s triggers separately rather than assuming one banner covers all of them, and talk to a privacy attorney when the stakes are real. This post is general information, not legal advice.