ComplyRoom US REGULATORY TRACKERGet deadline alerts
Dated research · 63 rules · 20 states · Data cutoff
AI & Privacy/Colorado/CO SB 21-190

Colorado Privacy Act

Enacted in force

Jurisdiction
Colorado [source]
Applies to
Unverified — Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s consumer-volume or data-sale conditions; entity and data exemptions apply. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) [source]
Penalty
Unverified — Attorney General/district attorney enforcement; penalty amount not verified. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) [source]
Detail review
Some fields Unverified
Nov 13, 2026
Some details remain Unverified. Official bill page returned HTTP 406 and AG page returned HTTP 403. Historical July 1, 2023 commencement and summarized duties remain unverified in this review. Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field. The law’s status is recorded separately as Enacted / in force. Source and qualifications

Fields requiring verification

  • operative date: Unverified — The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review. Primary source
  • legal effective date: Unverified — No distinct legal-effective date was established; do not substitute the operative/compliance date. Primary source
  • enforcement date: Unverified — No distinct enforcement-start date was established. Primary source
  • applies to: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • penalty: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. Primary source
  • consumer count: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • sale processing count: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • sale revenue percent: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • revenue threshold: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • threshold logic: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • small business: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • obligations: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • obligation 1: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • obligation 2: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source
  • obligation 3: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Primary source

In plain English

  • Unverified — Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s consumer-volume or data-sale conditions; entity and data exemptions apply. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) Primary source
  • Unverified — Provide a privacy notice and process consumer-rights requests. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) Primary source
  • Unverified — Provide applicable targeted-advertising, sale and profiling opt-outs. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) Primary source
  • Unverified — Obtain required sensitive-data consent and conduct required assessments. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) Primary source

Dates and phased obligations

Unverified — Reported base-law operative date: 2023-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force. (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.) Primary source

· operative
Reported base-law operative date: 2023-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force. Primary sourceUnverified date — monitor only

Questions from this record

Who does CO SB 21-190 cover?

Unverified — Controllers conducting business in Colorado or targeting Colorado residents that satisfy the statute’s consumer-volume or data-sale conditions; entity and data exemptions apply. (Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail.) Primary source

What is the law’s status?

Enacted / in force Primary source

What date does this record track?

Unverified — Reported base-law operative date: 2023-07-01. Exact date-field primary verification remains unresolved; the law itself is enacted and in force. (The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review.) Primary source

Has this record been verified?

Some detail fields remain Unverified. Legal status is recorded separately as Enacted / in force. operative date: Unverified — The historical operative date is reported, but its exact primary commencement clause was not independently confirmed in this review. legal effective date: Unverified — No distinct legal-effective date was established; do not substitute the operative/compliance date. enforcement date: Unverified — No distinct enforcement-start date was established. applies to: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. penalty: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. penalty amount: Unverified — Unverified: a current numeric penalty amount is not established by this review; retain any separately supported enforcement description. consumer count: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. sale processing count: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. sale revenue percent: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. revenue threshold: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. threshold logic: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. small business: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. obligations: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. obligation 1: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. obligation 2: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. obligation 3: Unverified — Unverified: this review did not establish the current field from retrievable primary text. The law’s in-force status is independent of this detail. Official bill page returned HTTP 406 and AG page returned HTTP 403. Historical July 1, 2023 commencement and summarized duties remain unverified in this review. Legal status correction: this enacted comprehensive framework is in force. Retrieval failures and unverified detail fields do not make the law Pending; unresolved dates, thresholds, coverage, duties and penalty detail remain flagged per field. Primary source

Primary sources

Verification history

  • — Facts and dates reconciled from the accepted T1 report. Source
  • — Accepted T1 report content changed. Source

Not legal advice. This page restates the linked record and does not determine whether a particular business is covered. Methodology and verification limits.

Compare the tracked rulesDates, coverage, and sources in one quarterly file.
View the matrix