Colorado Privacy Act (CPA, C.R.S. § 6-1-1301 et seq.)
Colorado comprehensive consumer privacy law with consumer rights, controller/processor obligations, universal opt-out mechanism requirement, and an AG enforcement framework with HIPAA carve-outs.
Primary source
C.R.S. § 6-1-1301 et seq. — Colorado AG →https://coag.gov/resources/colorado-privacy-act/
Verified May 23, 2026 · This is the authoritative regulator URL. The summary below is a research aid; the linked source controls.
Additional sources
The Colorado Privacy Act (CPA) — C.R.S. § 6-1-1301 et seq., effective July 1, 2023 — is Colorado's comprehensive consumer privacy law.
Applicability thresholds: controllers that conduct business in CO or produce products/services targeted to CO residents and that during a calendar year control or process personal data of 100,000+ consumers, or derive revenue (or receive a discount) from the sale of personal data and control/process the personal data of 25,000+ consumers.
Consumer rights: access, correction, deletion, data portability, opt-out (targeted advertising, sale, profiling that results in legal or similarly significant effects).
Universal opt-out mechanism (UOOM): starting July 1, 2024, controllers engaged in targeted advertising or sale of personal data must honor opt-out preference signals (the Global Privacy Control is the principal current example).
Controller obligations: transparency, data minimization, purpose limitation, reasonable security, data protection assessments for high-risk processing, processor contracts, opt-in for sensitive data.
HIPAA carve-outs: PHI is excluded; HIPAA covered entities and business associates are not entity-level excluded but PHI in their hands is data-level excluded.
Enforcement: Colorado AG and District Attorneys; 60-day cure period (sunset Jan 1, 2025); civil penalties up to $20,000 per violation. The Colorado AG has issued detailed CPA Rules (4 CCR 904-3) that operationalize the statute.
Use this in your workspace
D3rx assembles the documentation linked to this regulation, walks the practical decisions in plain English, and stores the artifacts against the .gov sources cited above. It is an administrative research aid, not a substitute for counsel.
Related regulations
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- RegulationCalifornia Confidentiality of Medical Information Act (CMIA, Cal. Civ. Code 56-56.37)California state law providing broader patient confidentiality protections than HIPAA for medical information held by providers, contractors, and certain employers.
- RegulationConnecticut Data Privacy Act (CTDPA, Public Act 22-15)Connecticut comprehensive consumer data privacy law with consumer rights, controller/processor obligations, and an AG enforcement framework — with substantial healthcare carve-outs.
- RegulationHIPAA Privacy Rule: General Rules for Uses and Disclosures (45 CFR 164.502)The general rules covered entities follow for any use or disclosure of protected health information, including the minimum necessary standard and treatment, payment, and operations exceptions.
- StateAlaska healthcare compliance overlayAlaska has no state-specific medical-information privacy statute beyond HIPAA, and no health-data-only breach rule.
- StateAlabama healthcare compliance overlayAlabama was the last U.
- StateArkansas healthcare compliance overlayArkansas's Personal Information Protection Act adds 'medical information' to the categories triggering breach notification but does not impose health-information-specific privacy rules beyond HIPAA.
- StateArizona healthcare compliance overlayArizona broadened its breach statute in 2018 to add medical information, health insurance identifiers, biometric data, and online credentials.
- ComplianceCalifornia Healthcare Compliance: CMIA + HIPAA — Where They DivergeCalifornia's CMIA (Civ. Code §§ 56–56.37) vs HIPAA: stricter consent, 5-working-day inspection / 15-day copy access, private right of action, up to $25k per knowing-and-willful violation + misdemeanor exposure.
Last reviewed May 23, 2026 · Citation verified May 23, 2026
Research aid, not legal advice. This summary is an administrative research aid prepared by D3rx. It does not certify compliance, provide legal advice, replace counsel, or guarantee an audit outcome. For authoritative regulatory text follow the primary source link at the top of this page. The practice remains responsible for reviewing, adopting, and maintaining its compliance program.