CPA Rulemaking Information
The Colorado Privacy Act (the “CPA”) gives the Colorado Attorney General the authority to promulgate rules including, but not limited to, general rules for the purpose of carrying out the CPA. Pursuant to that authority, on March 15, 2023, the Department of Law (the “DOL”) filed the Colorado Privacy Act Rules, 4 CCR 904-3 (the “CPA Rules”), which were published on March 25, 2023, and went into effect on July 1, 2023.
The CPA has been amended since it went into effect on July 1, 2023. On May 31, 2024, Governor Polis signed Senate Bill 24-041: Concerning Adding Data Protections for a Minor’s Online Activity. Senate Bill 24-041 amends Part 13 of the Colorado Privacy Act, C.R.S. §§ 6-1-1301, et seq. (“CPA”) to add provisions strengthening Personal Data protections for Minors. On May 23, 2025, Govenor Polis signed Senate Bill 25-276: Protecting Civil Rights Immigration Status. Senate Bill 25-276 amends part 13 of the CPA to add Precise Geolocation Data as covered Sensitive Data.
On July 29, 2025, the DOL filed a set of proposed draft amendments to the CPA rules (PDF). The purpose of these proposed draft amendments is to clarify the changes to the CPA made by Senate Bills 24-041 and 25-276.
The proposed draft amendments to the CPA Rules were filed with the Secretary of State on July 29, 2024, along with the notice of rulemaking and statement of basis, authority and purpose.
Read the notice of rulemaking hearing, and the statement of basis, authority, and purpose (PDF).
Public Input
The Colorado Attorney General’s Office believes it will produce better rules if it receives strong, diverse input from interested people and organizations.
The DOL accepted public input on pre-rulemaking considerations from June 23, 2025, through July 11, 2025. Pre-Rulemaking comments are available on the CPA comment rulemaking site.
The DOL is currently accepting comments on the draft amendments to the CPA. All members of the public are welcome to submit comments until September 10, 2025. Only the rule provisions included in the proposed draft amendments will be opened for comment during this rulemaking period. All comments received during the rulemaking period will be considered part of the formal rulemaking process and automatically added to the official rulemaking record. As soon as possible after receipt, written comments will be posted online at CPA rulemaking comment website.
Submit a comment (opens new tab).
Get more information on rulemaking.
Rulemaking Hearing
The DOL will hold a public rulemaking hearing on the proposed draft amendments to the CPA on September 10, 2025. The hearing will be conducted both in person and by video conference. All parties interested in attending the public hearing virtually must register through the registration link provided below in order to receive the Zoom meeting link. While parties interested in attending the public hearing in person are not required to register, we do encourage advanced registration for planning purposes. Any party in attendance will be invited to provide oral comments even if not registered in advance.
Register for the rulemaking hearing (opens new tab).
Cost Benefit Analysis
Pursuant to section 24-4-103(2.5), C.R.S., anyone can request a cost-benefit analysis on proposed rules within five days of publication in the Colorado Register. There are two ways that a Cost-Benefit Analysis (CBA) can be requested. You can either complete the “Request a Cost-Benefit Analysis” form, or email COPRRR directly. You may also request a CBA for the 2024 proposed draft amendments.