Colorado

Colorado implemented privacy-related legislation that applies to residents or activities that occur within the state, including breach notification or other data security laws. Companies in Colorado must comply not only with applicable federal law, but also with relevant state privacy and security laws and regulations.

State Government

Attorney General

Privacy Laws and Regulations

Colorado Privacy Act
Effective July 1, 2023
Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313
Amendments – § 6-1-1303 (Concerning Protecting the Privacy of an Individual’s Biological Data and Neural Data) (Effective August 6, 2024)
Amendments – § 6-1-1314 (Concerning Protecting the Privacy of an Individual’s Biometric Data) (2024) (Effective July 1, 2025)
Amendments – §§ 6-1-1302 to 6-1-1311 (Concerning Adding Data Protections for a Minor’s Online Activity) (Effective October 1, 2025)
Colorado Privacy Act Rules
4 CCR 904
Colorado Privacy Act Rules Amended (Effective July 1, 2025)
Disposal of Personal Identifying Information
Colo. Rev. Stat. § 6-1-713
Protection of Personal Identifying Information
Colo. Rev. Stat. § 6-1-713.5
Security Breach Notification
Colo. Rev. Stat. § 6-1-716
Social Security Number Prohibitions
Colo. Rev. Stat. § 6-1-715
Colo. Rev. Stat. § 4-3-506