Colorado Privacy Act (United States)
What the CPA covers, and what it means for your website analytics
Official name: Colorado Privacy Act (CPA), Senate Bill 21-190. In force since 1 July 2023, it gives Colorado residents rights over their personal data and sets duties for businesses that process it at scale.
See all privacy lawsAt a glance
Colorado's consumer privacy law
The CPA gives Colorado residents the right to access, correct, delete and take their personal data with them, and to opt out of targeted advertising, its sale and certain profiling. Processing sensitive data needs opt-in consent.
Who it covers
Firms serving Coloradans with data on 100,000+ people, or 25,000+ if they sell data
What it means for websites
Since July 2024, you must honor opt-out signals such as Global Privacy Control
Who enforces it
The Colorado Attorney General and district attorneys
Maximum fines
Up to $20,000 per violation, under the Colorado Consumer Protection Act
Further reading
Everything you need on this law
The CPA
The Colorado Privacy Act as passed in 2021 (Senate Bill 21-190), from the Colorado General Assembly.
Read the official billThe Colorado Privacy Act rules
The official rules that set out how businesses must comply, including with universal opt-out signals.
Read the rulesColorado Attorney General on privacy
The office that enforces the CPA, with guidance for consumers and businesses.
Visit the Attorney GeneralThe CCPA
California’s privacy law, the first of its kind in the US, enforced by its own dedicated agency.
Read our CCPA guideThe Virginia Consumer Data Protection Act
Virginia’s privacy law, which shares the CPA’s structure and thresholds but differs on opt-out signals.
Read our VCDPA guideMore privacy laws
Guides to 14 more laws, from the GDPR to the CCPA, and what each one asks of your website.
See all privacy lawsPrivacy by default
Less data, the same insights
TWIPLA’s default Maximum Privacy Mode keeps what you collect to a minimum, wherever your visitors are:
- Visitors are counted with a one-way hash, the only identifier stored
- Reports show trends across your audience, never one person’s page history
- All data is hosted in Germany, under a Data Processing Agreement that lists every subprocessor
- An optional opt-out link lets visitors switch off TWIPLA tracking entirely
Every privacy law sets its own rules. Custom Country Data lets you choose the privacy mode for visitors from each country, so you can match it to the law that applies there.
Proof, not promises
How TWIPLA respects your US visitors’ privacy
Privacy modes and country settings
How to choose one of four privacy modes, and set a different one for visitors by country.
Read the guideVisitor opt-out
Where any visitor can switch off TWIPLA tracking for themselves, at any time.
See the opt-outWhat to put in your privacy policy
Ready-to-use wording for describing TWIPLA in your privacy policy.
Get the wordingOur Data Processing Agreement
The processing agreement every TWIPLA customer signs, with all subprocessors listed.
Read the agreementthoughtbot
How a US design and development agency dropped its cookie banner and Google Analytics without losing insight.
Read the success storyLegal disclaimer
Helpful guidance, not legal advice
This page explains the law in general terms. Laws change, and how they apply depends on your business, your visitors and how you configure TWIPLA.
Unless another mode is named, statements about compliance refer to Maximum Privacy Mode, our default setting. For advice on your situation, please consult a qualified legal professional.
Questions about how TWIPLA fits this law? Email our team at consentless@twipla.com.
