What does the Colorado Privacy Act say about targeted advertising?
Part of US and Canada targeting
The short answer
The Colorado Privacy Act gives Colorado residents a right to opt out of targeted advertising, defined as ads selected from personal data gathered over time across nonaffiliated websites, apps or online services. Ads based on the context of a current search or visit are excluded. Since July 1, 2024 covered controllers must also honor recognized universal opt out mechanisms.
Key takeaways
- Colorado defines targeted advertising by cross site activity over time, and excludes ads chosen from the context of the current search, website visit or app.
- The act applies to controllers doing business in Colorado or targeting its residents that process data of 100,000 consumers a year, or 25,000 consumers plus revenue or discounts from data sales.
- Part 5 of the Attorney General's rules, 4 CCR 904-3, sets duties for the mechanism and for the controller receiving it.
- Minors provisions added by SB24-041 took effect October 1, 2025 and apply to controllers doing business in Colorado without the volume thresholds.
- Only the Attorney General and district attorneys enforce the act, and the general 60 day cure period ended January 1, 2025.
What does Colorado's opt out of targeted advertising cover?
Governor Polis signed Senate Bill 21-190 (opens in a new tab) on July 7, 2021, and the Colorado Attorney General (opens in a new tab) says the act went into effect July 1, 2023. Its consumer rights include opting out of the sale of personal data or its use for targeted advertising or certain kinds of profiling. Because the right attaches to a defined term, the definition decides which ad decisions it reaches.
Definition
- Targeted advertising (C.R.S. 6-1-1303)
- Displaying to a consumer an advertisement selected based on personal data obtained or inferred over time from the consumer's activities across nonaffiliated websites, applications or online services, to predict consumer preferences or interests.
Three parts of that sentence matter to a planner. The data must be personal data about a Colorado resident acting in an individual or household context, it must come from activity over time, and the activity must cross nonaffiliated websites, applications or online services. The statute then lists four exclusions.
| Ad decision | Where it sits in the definition | Statute wording that places it |
|---|---|---|
| Retargeting a person who left a product page on another site | Inside the definition | Personal data obtained over time across nonaffiliated websites |
| An ad chosen because the article being read matches the product | Excluded | Advertisements based on the context of a consumer's current visit to a website |
| An ad chosen from what a person did on the advertiser's own site | Excluded | Advertisements based on activities within a controller's own websites or online applications |
| An ad sent after a person asked for information | Excluded | Advertising in response to the consumer's request for information or feedback |
| Frequency and reach reporting | Excluded | Processing personal data solely for measuring or reporting advertising performance, reach, or frequency |
The opt out sits beside other duties. The Attorney General's FAQ says controllers must disclose clearly if personal data is sold or processed for targeted advertising, and offer a way to opt out in the privacy notice and in a readily accessible location outside it.
Who must comply with the Colorado Privacy Act?
Section 6-1-1304 sets a two part test: a connection to Colorado and at least one volume threshold. The Attorney General's FAQ adds that the act applies regardless of the controller's location.
| Test | What the text says | Note from the Attorney General |
|---|---|---|
| Connection to Colorado | Conducts business in Colorado or produces or delivers products or services intentionally targeted to Colorado residents | Location of the controller does not change enforcement |
| Volume threshold one | Controls or processes the personal data of 100,000 consumers or more during a calendar year | Consumer means a Colorado resident, so this is 100,000 Colorado residents, not 100,000 people nationwide |
| Volume threshold two | Derives revenue or a discount from the sale of personal data and processes the personal data of 25,000 consumers or more | Both parts must be met |
| Minors provisions (SB24-041) | Sections 6-1-1305.5, 6-1-1308.5 and 6-1-1309.5 apply to a controller that conducts business in Colorado or targets its residents | No volume threshold attached; in effect October 1, 2025 |
The Attorney General lists entity exclusions such as financial institutions subject to the Gramm Leach Bliley Act and air carriers, plus certain data held under federal laws such as HIPAA. Data about job applicants and people acting in an employment context falls outside the consumer definition.
SB24-041 (opens in a new tab), approved May 31, 2024, defines a minor as a consumer under eighteen. A controller offering an online service, product or feature to a consumer it actually knows or willfully disregards is a minor may not process that minor's data for targeted advertising without consent, which for a child means a parent's or guardian's consent.
What is a universal opt out mechanism in Colorado?
The statute required the Attorney General to adopt technical specifications for universal opt out mechanisms, and the final Colorado Privacy Act Rules (opens in a new tab) were filed on March 15, 2023 as 4 CCR 904-3. Part 5 governs both the tool that sends the choice and the controller that receives it. The recognized tool and how its browser signal works are covered on the Global Privacy Control page.
The purpose of a Universal Opt-Out Mechanism is to provide Consumers with a simple and easy-to-use method by which Consumers can automatically exercise their opt-out rights with all Controllers they interact with without having to make individualized requests with each Controller.
| Rule | Who it binds | What it says |
|---|---|---|
| 5.02(C) | Mechanism | May express an opt out of targeted advertising, of sale, or of both |
| 5.04(A) | Mechanism | May not be the default setting of a tool pre-installed with a device, such as a browser or operating system |
| 5.06(A) | Mechanism | Must reach multiple controllers automatically, in a format such as an HTTP header field or JavaScript object |
| 5.08(A) | Controller | From July 1, 2024, treats the request as valid for the browser or device and, if known, the consumer |
| 5.08(D) | Controller | May not require a login as a condition of recognizing the mechanism |
| 5.09(B) | Controller | May not read a later absence of the signal as consent to opt back in |
A controller can still ask a person who sent the signal to consent to targeted advertising. Section 6-1-1306 says that consent takes precedence if the controller first gives a clear and conspicuous notice of the choices, data categories and purposes, and lets the consumer revoke consent as easily as it was given.
Does contextual advertising count as targeted advertising in Colorado?
Not when the ad is selected from the context of the current visit. The statute excludes advertisements based on the context of a consumer's current search query, visit to a website or online application. A placement chosen because the article fits the product uses the page, not a person's history across sites, which is the contextual targeting method.
The exclusion covers the ad decision, not the other data flows attached to the impression. A contextual buy can still carry an advertiser's pixel, a retargeting tag or an audience overlay, each of which can involve personal data from activity across sites.
Facts a Colorado plan can record about each ad decision
- The placement was selected from the content of the page or the current search, with no cross site history.
- No audience segment, lookalike or retargeting list was layered onto the line item.
- Each tag on the advertiser's landing page is listed with the party that receives its data.
- Any measurement use of identifiers is limited to performance, reach or frequency reporting.
- The plan notes whether any targeted line could reach consumers the advertiser knows are under 18.
How is the Colorado Privacy Act enforced?
Section 6-1-1311 gives the Attorney General and district attorneys exclusive authority to enforce the act, including by seeking an injunction, and the act creates no private right of action. For their enforcement purposes a violation is a deceptive trade practice.
Under the original text, the Attorney General or a district attorney had to issue a notice of violation and allow sixty days to cure when a cure was deemed possible. That step was repealed effective January 1, 2025. SB24-041 kept a separate sixty day cure step for the minors sections, repealed effective December 31, 2026.
Public enforcement steps so far are letters and a joint sweep. On July 12, 2023 (opens in a new tab) the Attorney General announced educational letters to businesses, stressing consent for sensitive data and the duty to let consumers opt out of targeted advertising. On September 9, 2025 (opens in a new tab) California's Attorney General announced a sweep with Colorado and Connecticut, sending letters to businesses that did not appear to process Global Privacy Control opt outs.
What does a Colorado review look like for an advertiser based outside the state?
Fictional example. Unnamed brand, no results implied.
A Calgary bookseller plans a Denver and Boulder campaign
An unnamed online seller of used and rare books, based in Calgary, Alberta, plans display ads for readers in Denver and Boulder beside book reviews, author interviews and literary history articles. The client ships to Colorado, so its privacy lead asks the agency how the Colorado act could touch the campaign.
The planner separates two layers. The site list is built from article content, so placements fall under the exclusion for the context of the current visit. A second line would retarget past site visitors; the planner marks it as cross site activity within the definition and records that the client's site must honor recognized universal opt out mechanisms on that line. The client's own count of Colorado customers decides the threshold question, and its Alberta address does not change it.
How does PlacementGraph help build the contextual layer of a Colorado plan?
The contextual line in a plan like this is a site selection task, which is the part PlacementGraph does.
Frequently asked questions
Can a controller require a login before honoring a Colorado opt out signal?
Rule 5.08(D) says a controller may not require a consumer to log in or otherwise authenticate as a condition of recognizing a universal opt out mechanism, and may not impose unnecessary or unnecessarily burdensome authentication steps. Rule 5.08(F) lets a controller check Colorado residency but does not oblige it to.
Can a business ask for an email address when it receives the Colorado signal?
Rule 5.05(C) lets a controller offer the consumer the option to give a phone number or email address so the choice applies offline or across devices, and that information may be used only to process the opt out request.
Does the Colorado act cover employee and job applicant data?
The Attorney General's FAQ says the act does not apply to data maintained for employment records purposes, and the consumer definition excludes people acting in a commercial or employment context or as job applicants. It protects Colorado residents acting in an individual or household context.
Do Colorado's minors rules require websites to verify age?
SB24-041 says the act does not require a controller or processor to implement age verification or age gating or to collect consumers' ages. A controller that chooses commercially reasonable age estimation is not liable for an erroneous estimate. The duties attach when a controller actually knows or willfully disregards that a consumer is under 18.
Sources
- Colorado Privacy Act (CPA) (opens in a new tab)Colorado Attorney General
- Universal Opt-Out and the Colorado Privacy Act (opens in a new tab)Colorado Attorney General
- Colorado Privacy Act Rules, 4 CCR 904-3 (filed March 15, 2023) (opens in a new tab)Colorado Department of Law
- Senate Bill 21-190, Protect Personal Data Privacy (opens in a new tab)Colorado General Assembly
- SB24-041, Privacy Protections for Children's Online Data (Session Laws 2024, ch. 296) (opens in a new tab)Colorado General Assembly
- Attorney General Phil Weiser launches enforcement of Colorado Privacy Act (opens in a new tab)Colorado Attorney General
- Joint investigative privacy sweep: CO, CT and CA (opens in a new tab)California Department of Justice, Office of the Attorney General
Researched and written by PlacementGraph Research. Read how we research, source and update these pages. Corrections: diana@placementgraph.com.