Use Colorado privacy rights for household data

Check the kind of data and the company's coverage

The Attorney General describes CPA consumer rights for Colorado residents acting in a personal or household context, such as ordinary browsing or retail rewards use. This guide focuses on an adult making that kind of request. Specialized minor, biometric and employment situations need a separate review of the applicable provisions. Colorado Attorney General: consumer rights overview · Colorado: privacy rights and appeal statute

Coverage has thresholds and exemptions. Section 6-1-1304 sets the ordinary thresholds at 100,000 consumers in a calendar year, or 25,000 consumers when the controller derives revenue or receives a discount from selling personal data, together with the Colorado business or targeting requirement. It also has a biometric-data branch and separate minor-related provisions. A small organization is not automatically covered by every ordinary consumer right. Colorado: privacy rights and appeal statute

Choose the right request

Access lets a consumer confirm processing and access their personal data. Correction concerns inaccuracies. Deletion concerns personal data about the consumer. Portability concerns an accessible, transferable format, with statutory qualifications. Opt-outs concern sale, targeted advertising or profiling for decisions with legal or similarly significant effects. These are different rights; an advertising opt-out is not a request to erase the whole account. Colorado: privacy rights and appeal statute

Send a request through the published method

The company's privacy notice should explain how to exercise rights and appeal a decision. The statute does not allow a required new account just to exercise a right, although use of an existing account may be required. Authentication may be necessary; a controller unable to authenticate with commercially reasonable efforts may request reasonably necessary additional information. Colorado: privacy rights and appeal statute

1. Open the company's official website or app and find its privacy notice. Locate the Colorado or state privacy request method and appeal instructions. Colorado: privacy rights and appeal statute
2. Specify the right you want to exercise and the account or data involved. Use the company's designated method and complete its relevant identity check. Save the request date and acknowledgment for your own records. Colorado: privacy rights and appeal statute
3. Read any refusal or partial response for its stated reason and appeal route. If the result does not address the requested right, use the company's internal appeal process within its stated reasonable period. Colorado: privacy rights and appeal statute

Use GPC for its sale and targeted-advertising purpose

Colorado's recognized-mechanism page lists Global Privacy Control, or GPC, as the mechanism the Department currently considers valid for enforcement. Covered businesses must accept it for sale and targeted-advertising opt-outs beginning 07-01-2024. The page says to enable it separately in each browser or device you use. Colorado Attorney General: recognized opt-out mechanism

Check the company's explanation of how it handles that signal. For browser setup, use the linked GPC guide below. A GPC signal does not by itself submit an access, correction or deletion request; those rights have their own request method. If you separately give valid consent to sale or targeted advertising, section 6-1-1306 describes how that consent can take precedence and how it must be revocable. Colorado: privacy rights and appeal statute

Track the request clock and the appeal clock separately

The AG's complaint guidance describes a response within 45 days of a properly submitted rights request, with a further 45 days when needed and notice explaining the extension. The statute requires that notice during the original period. Colorado Attorney General: privacy complaints · Colorado: privacy rights and appeal statute

An internal appeal has a different extension rule. Section 6-1-1306(3) calls for an appeal response within 45 days, with up to 60 additional days where reasonably necessary because of complexity and number of requests. The controller must explain the delay within the original 45 days and tell the consumer about contacting the Attorney General concerning the result. Colorado: privacy rights and appeal statute

Prepare a complaint without expecting individual representation

The AG asks for a clear explanation, relevant dates, steps already taken, the company's identity and the right or obligation involved. Keep copies of the request, reply and appeal so those details are available. Its linked privacy-complaint portal is the official filing route; read its instructions before providing personal information. Colorado Attorney General: privacy complaints

The AG says complaints help identify trends and possible public enforcement, while its office cannot provide individual legal advice or representation or investigate or prosecute an individual case. The CPA itself does not create a private right of action, and enforcement rests with the Attorney General and district attorneys. Independent rights under other laws are a separate question. Colorado Attorney General: privacy complaints · Colorado: privacy rights and appeal statute