Colorado Privacy Act
What is Colorado Privacy Act?
The Colorado Privacy Act (CPA) grants Colorado residents rights over their personal data, including the right to access, correct, delete, and opt‑out of processing for targeted advertising, profiling, or other discriminatory purposes. It applies to controllers and processors that (a) conduct business in Colorado or target Colorado residents, (b) process personal data of at least 100,000 Colorado residents annually, or (c) derive revenue of $25 million or more from the personal data of Colorado residents. It comprises 22 controls organised across 5 domains, and applies in the United States - Colorado.
How Colorado Privacy Act maps to other frameworks
All 22 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 5 domains Colorado Privacy Act groups its controls into
Where Colorado Privacy Act overlaps with the standards you already hold
What Colorado Privacy Act means in your sector
What Colorado Privacy Act means for your job
Questions people ask about Colorado Privacy Act
What is Colorado Privacy Act?
How many controls does Colorado Privacy Act have?
Where does Colorado Privacy Act apply?
What frameworks does Colorado Privacy Act map to?
How do I get started with Colorado Privacy Act compliance?
Query Colorado Privacy Act programmatically
Colorado Privacy Act, its 22 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
Colorado Privacy Act API reference and MCP config →What Colorado Privacy Act requires, control by control
Each page carries the requirement text for one Colorado Privacy Act control and what an assessor expects to see as evidence.
- COPA-1304-SCOPE Applicability and Thresholds
- COPA-1305-PROCESSOR Processor Contracts and Role Responsibility
- COPA-1306-ACCESS Right of Access
- COPA-1306-CORRECT Right to Correction
- COPA-1306-OPTOUT Right to Opt Out
- COPA-1306-PORTABILITY Right to Data Portability
- COPA-1307-DEIDENT De-identified and Pseudonymous Data
- COPA-1308-CARE Duty of Care (Security)
- COPA-1308-CONSENT Valid Consent and Dark Patterns
- COPA-1308-MINIMIZATION Duty of Data Minimization
How ready are you for Colorado Privacy Act?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.