Página traduzida e verificada automaticamente. Prevalece a versão em inglês. Algumas partes ainda estão em inglês enquanto a tradução é verificada. Ver em inglês · Informar um erro de tradução
Regulamentações › Estados dos EUA › Colorado
CPA
Colorado Privacy Act
QuandoEm vigor desde 1º de julho de 2023
Quem fiscalizaProcurador-Geral do Colorado e promotores distritais
A quem se aplicaEmpresas que tratam dados pessoais de residentes do estado acima dos limites da lei. Os limites, as isenções e as regras sobre dados sensíveis variam por estado.
Limites de aplicabilidadeControladores que tratam dados de 100,000+ consumidores por ano, ou de 25,000+ consumidores obtendo…
Opt-out universalDeve respeitar mecanismos universais de opt-out reconhecidos pelo AG (p. ex., GPC) para anúncios direcionados e vendas s…
Período de saneamentoO prazo de correção de 60 dias foi revogado em 1º de janeiro de 2025
Prazo para solicitações45 dias, prorrogáveis por 45 dias mediante aviso
Penalidade máximaAté $20,000 por violação nos termos da Colorado Consumer Protection Act, $50,000 se contra um…
Ação privadaSem direito privado de ação
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
A quem se aplica
Limites de aplicabilidade
1
Controllers processing data of 100,000+ consumers a year, or 25,000+ consumers while deriving any revenue or discount from data sales; minors duties apply regardless.C.R.S. § 6-1-1304(1) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. No revenue-share minimum on the sale test; SB 24-041 minors duties bypass thresholds.
Isenções
2
GLBA financial institutions exempt at entity level; HIPAA PHI exempt at data level; nonprofits are covered.C.R.S. § 6-1-1304(2)(a), (2)(q) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Dados sensíveis e menores
Dados sensíveis
2
Opt-in consent for sensitive data, which includes biological and neural data since 2024; biometric identifier rules apply from July 1, 2025.C.R.S. §§ 6-1-1303(24), 6-1-1308(7) · secondary source · source ↗
Neural/biological data added by HB 24-1058 (Aug. 7, 2024); HB 24-1130 biometric rules July 1, 2025. Mirror text did not yet show these.
Crianças e adolescentes
3
Minors under 18: duty of care and consent required for targeted ads, sale, profiling, engagement features and precise geolocation; parental consent under 13.C.R.S. § 6-1-1308.5 (SB 24-041) · source ↗
Effective Oct. 1, 2025. Codified section number not confirmed this session; 'minor' = under 18 confirmed via TrueVault.
Minimização de dados
1
Collection must be adequate, relevant and limited to what is reasonably necessary for specified express purposes; new purposes need consent.C.R.S. § 6-1-1308(2)-(4) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. CPA Rules add purpose specification and retention detail.
Direitos dos consumidores
Direitos
2
Access, correct, delete, portability, and opt out of targeted advertising, sale and significant profiling.C.R.S. § 6-1-1306(1) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Prazo para solicitações
2
45 days, extendable by 45 days with notice.C.R.S. § 6-1-1306(2) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Recursos
3
Internal appeal answered within 45 days (extendable 60); consumer must be told they can contact the Attorney General.C.R.S. § 6-1-1306(3) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Opt-out universal
2
Must honor AG-recognized universal opt-out mechanisms (e.g., GPC) for targeted ads and sales since July 1, 2024.C.R.S. § 6-1-1306(1)(a)(IV); § 6-1-1313(2) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Deveres das empresas
Avaliações
2
Assessments required before targeted ads or risky profiling, sale and sensitive data processing; must be provided to the AG on request.C.R.S. § 6-1-1309(1)-(4) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. Rules (Part 8) prescribe content. Colorado AI Act is separate.
Contratos com operadores
3
Binding contract with instructions, deletion, compliance info and audits; subcontractors only after controller can object, under flow-down contracts.C.R.S. § 6-1-1305(3), (5) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Aviso de privacidade
3
Statutory notice of categories, purposes, rights and third parties, with detailed content and format rules in the CPA Rules.C.R.S. § 6-1-1308(1)(a); 4 CCR 904-3, Rule 6.02 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. Rule number from regulation knowledge; not read this session.
Programas de fidelidade
3
Bona fide loyalty programs allowed; rules require registration disclosures, partner lists, sensitive data explanations and 24-hour notice before ending benefits.C.R.S. § 6-1-1308(1)(d); 4 CCR 904-3, Rule 6.05 · secondary source · source ↗
Rule text read on Justia mirror of the Code of Colorado Regulations.
Dados desidentificados
3
Deidentified data needs reasonable measures, public commitment and contracts; pseudonymous data defined with separation requirements and rights carve-outs.C.R.S. §§ 6-1-1303(11), (22); 6-1-1307 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments. § 6-1-1307 carve-outs not read this session.
Fiscalização
Quem fiscaliza
2
Attorney General and district attorneys enforce; AG has rulemaking authority.C.R.S. §§ 6-1-1311(1)(a), 6-1-1313 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Período de saneamento
1
60-day cure period was repealed January 1, 2025.C.R.S. § 6-1-1311(1)(d) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Penalidade máxima
3
Up to $20,000 per violation under the Colorado Consumer Protection Act, $50,000 if against an elderly person.C.R.S. § 6-1-112(1)(a), (c) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Ação privada
0
No private right of action.C.R.S. § 6-1-1310(1); § 6-1-1311(1)(b) · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Regulamentação
3
AG rules in force (Colorado Privacy Act Rules, 4 CCR 904-3), including universal opt-out specifications.C.R.S. § 6-1-1313; 4 CCR 904-3 · secondary source · source ↗
Read on colorado.public.law, a mirror of C.R.S.; the mirror may lag recent amendments.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulamentações
Todas as leis estaduais de privacidade dos EUA em um só mapa
24 estados têm uma lei abrangente de privacidade na biblioteca, ao lado das leis da UE, do Reino Unido, federais dos EUA e globais: 102 no total, cada uma explicada em linguagem simples com suas fontes. Selecione um estado para ver o que se aplica lá.
- Em vigor
- Entrando em vigor
- Leis setoriais