Colorado Privacy Act
What is Colorado Privacy Act?
The Colorado Privacy Act (CPA) grants Colorado residents rights over their personal data, including the right to access, correct, delete, and opt‑out of processing for targeted advertising, profiling, or other discriminatory purposes. It applies to controllers and processors that (a) conduct business in Colorado or target Colorado residents, (b) process personal data of at least 100,000 Colorado residents annually, or (c) derive revenue of $25 million or more from the personal data of Colorado residents. It comprises 21 controls organised across 5 domains, and applies in the United States - Colorado.
How Colorado Privacy Act maps to other frameworks
All 21 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 5 domains Colorado Privacy Act groups its controls into
Frameworks that share controls with Colorado Privacy Act
Each of these has at least one control mapped to a control in Colorado Privacy Act. The number is how many Colorado Privacy Act controls are shared, counted from the mapping graph.
Implementation guides for frameworks that overlap Colorado Privacy Act
Where Colorado Privacy Act overlaps with the standards you already hold
Where to get trained on Colorado Privacy Act
One course in the catalogue covers Colorado Privacy Act directly. Each is self-paced, includes the downloadable toolkit and the implementation playbook, and carries a certificate of completion.
Training more than one person? Ten seats of any course is $1,490 on a single licence, against $199 a seat bought one at a time.
What an auditor will ask you for
All 22 Colorado Privacy Act controls, each with what it requires, the artefacts an auditor will ask you for, and where it commonly fails. Free to read, nothing to fill in.
Read the Colorado Privacy Act evidence request listWhat Colorado Privacy Act means in your sector
What Colorado Privacy Act means for your job
Questions people ask about Colorado Privacy Act
What is Colorado Privacy Act?
How many controls does Colorado Privacy Act have?
Where does Colorado Privacy Act apply?
What frameworks does Colorado Privacy Act map to?
How do I get started with Colorado Privacy Act compliance?
Query Colorado Privacy Act programmatically
Colorado Privacy Act, its 21 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
Colorado Privacy Act API reference and MCP config →What Colorado Privacy Act requires, control by control
Each page carries the requirement text for one Colorado Privacy Act control and what an assessor expects to see as evidence.
- COPA-1304-SCOPE Applicability and Thresholds
- COPA-1305-PROCESSOR Processor Contracts and Role Responsibility
- COPA-1306-ACCESS Right of Access
- COPA-1306-CORRECT Right to Correction
- COPA-1306-OPTOUT Right to Opt Out
- COPA-1306-PORTABILITY Right to Data Portability
- COPA-1307-DEIDENT De-identified and Pseudonymous Data
- COPA-1308-CARE Duty of Care (Security)
- COPA-1308-CONSENT Valid Consent and Dark Patterns
- COPA-1308-MINIMIZATION Duty of Data Minimization
How ready are you for Colorado Privacy Act?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.