Colorado Privacy Act (CPA)
What is Colorado Privacy Act (CPA)?
The Colorado Privacy Act (effective July 1, 2023) provides comprehensive consumer privacy rights for Colorado residents. It applies to controllers conducting business in Colorado or producing products/services targeted to Colorado residents that control or process personal data of 100,000+ consumers annually, or 25,000+ consumers while deriving revenue from sale of personal data. It comprises 59 controls organised across 5 domains, and applies in the United States — Colorado.
How Colorado Privacy Act (CPA) maps to other frameworks
All 59 controls, each one mapped to the equivalent requirement in other standards, with the evidence that carries across and the mappings that were judged and rejected shown alongside. No account needed to look.
See the control mappings →The 5 domains Colorado Privacy Act (CPA) groups its controls into
Where Colorado Privacy Act (CPA) overlaps with the standards you already hold
What Colorado Privacy Act (CPA) means in your sector
What Colorado Privacy Act (CPA) means for your job
Questions people ask about Colorado Privacy Act (CPA)
What is Colorado Privacy Act?
How many controls does Colorado Privacy Act have?
Where does Colorado Privacy Act apply?
What frameworks does Colorado Privacy Act map to?
How do I get started with Colorado Privacy Act compliance?
Query Colorado Privacy Act (CPA) programmatically
Colorado Privacy Act (CPA), its 59 controls and every mapping into other standards are available over a REST endpoint and an MCP server, so an agent can read them directly. The free tier is 10 calls a day and needs no signup.
Colorado Privacy Act (CPA) API reference and MCP config →What Colorado Privacy Act (CPA) requires, control by control
Each page carries the requirement text for one Colorado Privacy Act (CPA) control and what an assessor expects to see as evidence.
- COPA-1304-SCOPE Applicability and Thresholds
- COPA-1305-PROCESSOR Processor Contracts and Role Responsibility
- COPA-1306-ACCESS Right of Access
- COPA-1306-CORRECT Right to Correction
- COPA-1306-OPTOUT Right to Opt Out
- COPA-1306-PORTABILITY Right to Data Portability
- COPA-1307-DEIDENT De-identified and Pseudonymous Data
- COPA-1308-CARE Duty of Care (Security)
- COPA-1308-CONSENT Valid Consent and Dark Patterns
- COPA-1308-MINIMIZATION Duty of Data Minimization
How ready are you for Colorado Privacy Act (CPA)?
Answer 25 questions and get a professional readiness report with gap analysis, maturity scores, and prioritised action items. Results in 5 minutes.