← ALL REGULATIONS
Colorado Privacy Act cookie rules, and the GPC signal.
Colorado lets sites set advertising cookies without opt-in consent, but consumers must be able to opt out of targeted advertising and the sale of their data. Since 1 July 2024, a universal opt-out signal such as Global Privacy Control (GPC) has to be honoured as that opt-out.
Colorado Privacy Act at a glanceOpt-out, opt-in for some data
- Applies to
- Controllers handling data of 100,000+ Colorado residents a year, or 25,000+ while earning revenue from selling it
- In force
- July 2023, with universal opt-out signals required since July 2024
- Enforced by
- Colorado Attorney General and district attorneys
- Penalties
- Up to $20,000 per violation, under the Colorado Consumer Protection Act
WHAT COLORADO PRIVACY ACT REQUIRES
What Colorado asks of a site that uses advertising cookies.
THE RULEHonour universal opt-out signalsThe Attorney General recognises Global Privacy Control as a universal opt-out mechanism, and controllers must treat it as an opt-out of targeted advertising and sale.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEA clear opt-out of targeted advertisingConsumers need a clear and conspicuous way to opt out of targeted advertising and the sale of their personal data.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Colorado-specific label.
THE RULEConsent for sensitive dataProcessing sensitive data, such as health information, religious beliefs or precise location, needs opt-in consent.
WITH KATLAKatla’s categories describe what cookies are for, not which data types they carry. A site that processes sensitive data can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULENo dark patternsConsent obtained through a dark pattern is not valid consent under the Act.
WITH KATLAIn CCPA mode the opt-out is the banner’s main button, on its first layer.
Colorado Privacy Act questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Is Global Privacy Control mandatory in Colorado?
- Yes. Since 1 July 2024, controllers must honour a universal opt-out mechanism, and Global Privacy Control is on the Attorney General’s list of recognised mechanisms.
- Does Colorado require a cookie banner?
- Not an opt-in one. It requires a clear way to opt out of targeted advertising and sale, and honouring opt-out signals.
- Is there still a cure period?
- No. The 60-day period to cure a violation after notice ended on 1 January 2025.
- Do other US states work the same way?
- Most state privacy laws follow the same opt-out model, including those of Virginia, Connecticut and Utah, and several of them also require honouring opt-out signals.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.