Does the Colorado Privacy Act apply to you?

The Colorado Privacy Act is easy to misjudge because it does not care how large your business is in dollars. A modest company can be fully covered while a much larger one, handling fewer Colorado consumers, is not. What follows is the applicability test as the statute frames it, and the duties that attach once you are in.

Who the Colorado Privacy Act covers

The law applies to controllers that conduct business in Colorado or deliver commercial products or services intentionally targeted to Colorado residents, and that meet one of two volume thresholds. The first is controlling or processing the personal data of 100,000 or more consumers during a calendar year. The second is deriving any revenue, or a discount on goods or services, from selling personal data while controlling or processing the data of 25,000 or more consumers. Notably there is no revenue-size floor: your total turnover does not enter the test.

The 25,000-consumer branch is not a percentage

A frequent error, repeated by some secondary trackers, is to describe the 25,000-consumer branch as requiring 50 percent of revenue from selling data. That is wrong for Colorado. The branch turns on deriving any revenue at all, or even a discount, from selling personal data. If you sell data and touch 25,000 Colorado consumers, you can be covered even where the sale is a small line of income. Read this branch literally before concluding you are outside the law.

What covered controllers must do

Covered controllers maintain a privacy notice and update it on any material change, apply data minimization and purpose limitation, and obtain opt-in consent before processing sensitive data. They must honor opt-outs, including a universal opt-out mechanism, conduct data protection assessments for high-risk processing, and enter data processing agreements with processors. Colorado consumers hold rights to access and confirm, correct, delete, data portability, opt out of targeted advertising, sale, and profiling for significant decisions, opt-in consent for sensitive data, the universal opt-out mechanism, and appeal.

How Colorado compares

Colorado's consumer-count approach lines up more closely with the Connecticut Data Privacy Act than with California. The CCPA, by contrast, brings revenue and data-sale percentages into the test. States like Kentucky and Virginia use the same 100,000-consumer idea but fix their second branch to a set percentage of data-sale revenue, the prong Colorado leaves open. Comparing them at the US state privacy laws hub helps you see why one business can be covered in Colorado but not in California, or the reverse.

Next step

If you are near either threshold, or you sell any data and are unsure of your Colorado consumer count, run the free 2-minute Obligation Scan. It checks both branches for you and lists the specific obligations that follow, so you can prioritize the ones that actually apply.