How long does a business have to respond to a Colorado privacy request?

Colorado looks like every other 45-day state until you reach the appeal subsection. Then it does something no other state privacy law does: it extends the appeal window by sixty days rather than forty-five. If you built one timer for all your states, Colorado is where it is wrong.

The 45-day rule

C.R.S. Section 6-1-1306(2)(a) provides that a controller shall inform a consumer of any action taken on a request without undue delay and, in any event, within forty-five days after receipt of the request.

Read the verb. The duty is to inform the consumer of the action taken, not to have started work or to have acknowledged receipt. An acknowledgment on day 44 does not satisfy the section.

The controller may extend the forty-five-day period by forty-five additional days where reasonably necessary, taking into account the complexity and number of the requests. The extension carries a condition: the controller shall inform the consumer of an extension within forty-five days after receipt of the request, together with the reasons for the delay.

So the extension is something you claim in time, in writing, with a reason. Silence past day 45 is a missed deadline, not a quiet extension.

Declining is due on the same clock

Section 6-1-1306(2)(b): if a controller does not take action on the request of a consumer, the controller shall inform the consumer, without undue delay and at the latest within forty-five days after receipt, of the reasons for not taking action and instructions for how to appeal the decision with the controller.

Two required elements, not one. A refusal that gives reasons but no appeal instructions is incomplete under the statute.

The appeal clock: 45 days, extendable by 60

This is the Colorado-specific detail.

Section 6-1-1306(3)(a) requires an appeal process, available within a reasonable period after the consumer receives the notice under subsection (2)(b), and it must be conspicuously available and as easy to use as the process for submitting a request. That phrasing is stricter than it looks: a self-serve request form paired with an appeals process that requires emailing a legal address does not meet it.

Section 6-1-1306(3)(b) then provides that within forty-five days after receipt of an appeal, a controller shall inform the consumer of any action taken or not taken in response to the appeal, along with a written explanation of the reasons in support of the response. The controller may extend the forty-five-day period by sixty additional days where reasonably necessary, taking into account the complexity and number of requests serving as the basis for the appeal, and must inform the consumer of the extension within forty-five days after receipt of the appeal, together with the reasons for the delay.

Forty-five plus sixty. Texas and Nebraska both run a flat sixty-day appeal deadline with no extension mechanism at all. Colorado runs a shorter base window with a longer extension, which means a multi-state appeals workflow cannot use one number.

Section 6-1-1306(3)(c) closes the loop: the controller shall inform the consumer of the consumer's ability to contact the attorney general if the consumer has concerns about the result of the appeal.

No forced account creation

Section 6-1-1306(1) sets out how requests come in, and it contains a rule worth building to: controllers shall not require a consumer to create a new account in order to exercise consumer rights, but may require a consumer to use an existing account.

The submission method must also take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication relating to the request, and the ability of the controller to authenticate the identity of the consumer making the request. Those three factors are the test for whether your chosen channel is adequate.

Why deadlines matter more in Colorado than next door

In Texas and Nebraska, a missed deadline reaches a penalty only after the attorney general sends a notice and you fail to cure within 30 days. Colorado repealed its general cure right. A violation there is a deceptive trade practice carrying up to $20,000 per violation, and each consumer counts separately.

That changes what a missed deadline is worth. A response process that runs late across your Colorado user base is not a warning letter waiting to happen; it is a multiplier. See Colorado Privacy Act fines for how that arithmetic works.

Next step

Colorado, Texas, Nebraska, Virginia and Delaware all start at 45 days and then diverge on extensions, appeals and consequences. The free 2-minute Obligation Scan checks your business against every US state privacy law and GDPR at once so you build to the deadlines that actually apply. For applicability, see the Colorado Privacy Act overview; to compare states, see privacy request response deadlines by state.