Colorado data privacy and data broker removal

Colorado has a comprehensive privacy law that gives you the right to access, delete, and control your personal data. Here's how those rights work in practice, and how to get yourself off data brokers.

Your rights in Colorado

Colorado residents are protected by the Colorado Privacy Act (CPA).

• Right to access and know. Request a copy of the personal information a company holds about you.
• Right to correct. Request corrections to inaccurate personal information.
• Right to delete. Ask a company to delete your personal information.
• Right to data portability. Get your data in a portable format you can take to another service.
• Right to opt out of sale. Tell a company to stop selling your personal information.
• Right to opt out of targeted advertising. Stop companies from targeting you with ads based on your personal data.
• Right to opt out of profiling. Stop companies from building a behavioral profile about you.
• Right to appeal. Challenge a company's decision to deny your privacy request.

Does this cover the company that has my data?

Most companies that collect or sell personal data in Colorado are likely covered. The law reaches companies doing business in Colorado, or targeting Colorado residents, that either process the personal data of 100,000 or more consumers in a year, or make money from selling personal data while processing the data of 25,000 or more consumers.

How to remove yourself from data brokers in Colorado

Colorado law gives you the right to request deletion. Exercising it everywhere your information shows up takes real, repeated effort. Here are the most effective steps, in order.

1. Enable Global Privacy Control

Global Privacy Control is a free browser setting that automatically tells every website you visit not to sell or share your data. It takes two minutes to enable and works silently in the background. Colorado was the first state to formally recognize it as a valid universal opt-out signal, so honoring it is a legal obligation for covered businesses, not just a courtesy.

2. Submit direct opt-out requests

For companies not reached by Global Privacy Control, you can submit requests directly. Look for the "Do not sell my personal information" link in a company's website footer; most major brokers have one. You can also file access, deletion, or correction requests through each company's privacy page.

Under Colorado's law, covered companies must respond within the statutory deadline. If they don't, you have grounds to file a complaint with the Colorado Attorney General and district attorneys.

3. Keep it removed over time

Here's the part nobody tells you: even after you complete every step above, brokers re-ingest your information from public records and commercial databases. Within a few months, your profiles reappear. Staying removed isn't a one-time task; it's ongoing work that's hard to keep up with by hand.

Colorado's data broker law: what it means for you

Colorado does not have a dedicated data-broker registry. Most national brokers are registered in California and honor opt-out requests from residents of any state, but without a Colorado law requiring it, you have little recourse if a broker ignores your request. Delist handles these requests across the sites where your information shows up, in one place.

Other privacy protections in Colorado

Beyond the comprehensive privacy law, Colorado has additional protections that may apply to you:

• An Address Confidentiality Program for survivors of domestic violence, sexual assault, or stalking, administered by the Colorado Secretary of State.
• C.R.S. § 18-9-313 restricts posting the personal information of protected persons (law-enforcement officials, certain public servants, domestic-violence and stalking victims, human-services workers) online on request, a partial Daniel's-Law-style protection.
• Biometric notice and consent obligations under HB 24-1130 (effective July 1, 2025), enforced by the Attorney General. There is no standalone biometric statute with a private right of action.
• Heightened protections for known children's data.

How to file a privacy complaint in Colorado

Colorado Attorney General (Colorado Department of Law), Consumer Protection: https://coag.gov/resources/colorado-privacy-act/

Most state agencies enforce privacy laws in the aggregate, investigating patterns of violations rather than resolving individual disputes. Filing a complaint still matters: it creates a record that helps trigger enforcement actions.

Frequently asked questions

Sources

• coag.gov
• alstonprivacy.com
• law.justia.com
• leg.colorado.gov