California and Colorado controls can share evidence, but the laws have different scope tests, actor names, sensitive-data rules, opt-outs, and enforcement routes.
Run both scope tests first, then compare the same data flow, purpose, recipient, consumer right, and control under each law.
The CCPA as amended by the CPRA applies to qualifying businesses doing business in California. The (CPA), effective July 1, 2023, applies to qualifying controllers that conduct business in Colorado or target commercial products or services to Colorado residents. One organization may be covered by both, one, or neither. Keep a separate legal finding for each state.
Side-by-side comparison
CPRA vs Colorado Privacy Act
Apply every row to the same entity and processing activity. Coverage under one law does not establish coverage under the other.
California regulates qualifying businesses and defines recipient roles, sale, sharing, consumer rights, and sensitive-personal-information limits within the CCPA.
Second framework
Colorado Privacy Act
Colorado regulates qualifying controllers and processors and has separate consent, opt-out, appeal, contract, and assessment rules.
A qualifying for-profit entity doing business in California is a business if it meets a statutory route: annual gross revenue above the adjusted threshold; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Other affiliate, joint-venture, and voluntary-certification routes can apply.
Subdivision (d) defines a California business and its threshold routes.
The CPA covers a controller that conducts business in Colorado or targets commercial products or services to Colorado residents and controls or processes data of at least 100,000 Colorado consumers in a calendar year, or at least 25,000 consumers while receiving revenue or a discount from selling personal data. Since July 1, 2025, it also covers a controller that processes any amount of biometric identifiers or biometric data, limited to that processing if the controller does not meet a general threshold. Nonprofits can be covered.
The enacted amendment adds the any-volume biometric-data scope route.
Calculate each threshold from its own definitions and period, and test Colorado's separate biometric-data route. Colorado's lower general route does not require that 50% of revenue come from sales, and California's revenue route does not require a consumer count.
California's consumer definition is tied to California residency and is not limited to an individual acting only in a personal or household context. Specific statutory exemptions still require analysis.
A Colorado consumer is a Colorado resident acting only in an individual or household context. The definition excludes a person acting in a commercial or employment context, and the CPA generally excludes data maintained for employment-record purposes. Separate biometric provisions nevertheless regulate specified employer processing of employee and prospective-employee biometric identifiers.
Section 6-1-1314 adds specific rules for employer processing of employee and prospective-employee biometric identifiers.
Do not exclude workforce or business-contact data from California merely because Colorado generally excludes that context, and assess Colorado's separate biometric rules where applicable.
California provides rights to know or access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment. Response and verification rules depend on the request.
The FAQ summarizes California consumer rights under the amended CCPA.
Colorado provides access, correction, deletion, portability, and opt-outs from sale, targeted advertising, and specified profiling. A controller must offer an internal appeal process when it refuses to act on a request.
California sale includes specified disclosures for monetary or other valuable consideration. Sharing separately covers disclosures for cross-context behavioral advertising whether or not money or other valuable consideration is exchanged. Covered businesses must process applicable opt-out preference signals under the regulations.
Colorado sale and targeted advertising are separate opt-out categories under Colorado definitions. Since July 1, 2024, controllers must accept recognized universal opt-out mechanisms for sale and targeted advertising.
The Attorney General states the July 1, 2024 universal opt-out requirement and its application to sale and targeted advertising.
Send a signal to each state's legal classifier. A disclosure that is not a Colorado sale may still be Colorado targeted advertising, California sharing, or a California sale.
California defines sensitive personal information and lets consumers limit uses and disclosures outside specified permitted purposes. Sensitive personal information processed without the purpose of inferring characteristics is not subject to the right to limit, though other CCPA duties still apply.
Section 1798.121 defines the conditional right to limit and its non-inference qualification.
Colorado requires consent before processing sensitive data. Sensitive data includes specified revealing data, biometric data used for identification, and personal data from a known child; child data must be processed with parental consent as required by COPPA.
The official FAQ explains sensitive-data categories and affirmative-consent requirements.
Do not use one blanket sensitive-data rule. Colorado asks whether consent is required before processing; California asks whether the category and purpose trigger the right to limit.
California requires role-specific contract terms for disclosures to service providers, contractors, and third parties. Its risk-assessment and cybersecurity-audit regulations apply only when their separate triggers and phase-in rules are met.
The CPPA regulations provide the current California contract, risk-assessment, and cybersecurity-audit requirements.
Colorado controller-processor contracts must govern processing instructions, purpose, data type, duration, rights and duties, confidentiality, deletion or return, audits, and subcontractors. Controllers must conduct data protection assessments for processing presenting a heightened risk of harm.
The California Privacy Protection Agency can bring administrative actions, and the California Attorney General can bring civil actions. California also has a limited private cause of action for specified security incidents, not for every statutory violation.
Sections 1798.150, 1798.155, and 1798.199.10 et seq. establish California remedies and enforcement authority.
The Colorado Attorney General and district attorneys enforce the CPA through the Colorado Consumer Protection Act. The CPA does not create a private right of action.
The enacted law states the enforcement structure and that it does not create a private right of action.
Scope thresholds
California CCPA as amended by CPRA
A qualifying for-profit entity doing business in California is a business if it meets a statutory route: annual gross revenue above the adjusted threshold; buying, selling, or sharing personal information of 100,000 or more consumers or households; or deriving at least 50% of annual revenue from selling or sharing consumers' personal information. Other affiliate, joint-venture, and voluntary-certification routes can apply.
Subdivision (d) defines a California business and its threshold routes.
Colorado Privacy Act
The CPA covers a controller that conducts business in Colorado or targets commercial products or services to Colorado residents and controls or processes data of at least 100,000 Colorado consumers in a calendar year, or at least 25,000 consumers while receiving revenue or a discount from selling personal data. Since July 1, 2025, it also covers a controller that processes any amount of biometric identifiers or biometric data, limited to that processing if the controller does not meet a general threshold. Nonprofits can be covered.
The enacted amendment adds the any-volume biometric-data scope route.
Operational implication
Calculate each threshold from its own definitions and period, and test Colorado's separate biometric-data route. Colorado's lower general route does not require that 50% of revenue come from sales, and California's revenue route does not require a consumer count.
The enacted amendment establishes the separate biometric-data route.
Who is a consumer
California CCPA as amended by CPRA
California's consumer definition is tied to California residency and is not limited to an individual acting only in a personal or household context. Specific statutory exemptions still require analysis.
A Colorado consumer is a Colorado resident acting only in an individual or household context. The definition excludes a person acting in a commercial or employment context, and the CPA generally excludes data maintained for employment-record purposes. Separate biometric provisions nevertheless regulate specified employer processing of employee and prospective-employee biometric identifiers.
Section 6-1-1314 adds specific rules for employer processing of employee and prospective-employee biometric identifiers.
Operational implication
Do not exclude workforce or business-contact data from California merely because Colorado generally excludes that context, and assess Colorado's separate biometric rules where applicable.
The enacted amendment establishes the separate employer-biometric provisions.
Consumer rights and appeals
California CCPA as amended by CPRA
California provides rights to know or access, delete, correct, opt out of sale or sharing, limit certain uses and disclosures of sensitive personal information, and receive non-discriminatory treatment. Response and verification rules depend on the request.
The FAQ summarizes California consumer rights under the amended CCPA.
Colorado Privacy Act
Colorado provides access, correction, deletion, portability, and opt-outs from sale, targeted advertising, and specified profiling. A controller must offer an internal appeal process when it refuses to act on a request.
The rules give operational requirements for rights methods, responses, and appeals.
Sale, advertising, and opt-out signals
California CCPA as amended by CPRA
California sale includes specified disclosures for monetary or other valuable consideration. Sharing separately covers disclosures for cross-context behavioral advertising whether or not money or other valuable consideration is exchanged. Covered businesses must process applicable opt-out preference signals under the regulations.
Colorado sale and targeted advertising are separate opt-out categories under Colorado definitions. Since July 1, 2024, controllers must accept recognized universal opt-out mechanisms for sale and targeted advertising.
The Attorney General states the July 1, 2024 universal opt-out requirement and its application to sale and targeted advertising.
Operational implication
Send a signal to each state's legal classifier. A disclosure that is not a Colorado sale may still be Colorado targeted advertising, California sharing, or a California sale.
The regulations govern California opt-out preference signals and the actions required after receipt.
Sensitive data
California CCPA as amended by CPRA
California defines sensitive personal information and lets consumers limit uses and disclosures outside specified permitted purposes. Sensitive personal information processed without the purpose of inferring characteristics is not subject to the right to limit, though other CCPA duties still apply.
Section 1798.121 defines the conditional right to limit and its non-inference qualification.
Colorado Privacy Act
Colorado requires consent before processing sensitive data. Sensitive data includes specified revealing data, biometric data used for identification, and personal data from a known child; child data must be processed with parental consent as required by COPPA.
The official FAQ explains sensitive-data categories and affirmative-consent requirements.
Operational implication
Do not use one blanket sensitive-data rule. Colorado asks whether consent is required before processing; California asks whether the category and purpose trigger the right to limit.
The rules specify how Colorado consent must be obtained, refreshed, and withdrawn.
Contracts and assessments
California CCPA as amended by CPRA
California requires role-specific contract terms for disclosures to service providers, contractors, and third parties. Its risk-assessment and cybersecurity-audit regulations apply only when their separate triggers and phase-in rules are met.
The CPPA regulations provide the current California contract, risk-assessment, and cybersecurity-audit requirements.
Colorado Privacy Act
Colorado controller-processor contracts must govern processing instructions, purpose, data type, duration, rights and duties, confidentiality, deletion or return, audits, and subcontractors. Controllers must conduct data protection assessments for processing presenting a heightened risk of harm.
The California Privacy Protection Agency can bring administrative actions, and the California Attorney General can bring civil actions. California also has a limited private cause of action for specified security incidents, not for every statutory violation.
Sections 1798.150, 1798.155, and 1798.199.10 et seq. establish California remedies and enforcement authority.
Colorado Privacy Act
The Colorado Attorney General and district attorneys enforce the CPA through the Colorado Consumer Protection Act. The CPA does not create a private right of action.
Official source for the Colorado findings and operational guidance.
1
Section 1
What should a multistate team decide first?
Start with scope. California generally uses a for-profit business test with revenue, data-volume, and sale-or-sharing revenue routes. Colorado can cover nonprofits and has no standalone revenue threshold; its two general routes depend on the number of Colorado consumers whose data is controlled or processed, with a sale-related condition for the lower threshold. Since July 1, 2025, Colorado also covers a controller's processing of any amount of biometric identifiers or biometric data, limited to that processing if the controller does not meet a general threshold.
If both laws apply, classify the same processing under each law. California distinguishes sale from sharing for cross-context behavioral advertising. Colorado separately regulates sale and targeted advertising. The terms overlap, but their definitions and exceptions are not identical.
Count the people and households specified by each law; do not copy one state's threshold worksheet into the other.
Separate consumer data from employment and commercial-contact data because Colorado excludes those contexts from its consumer definition.
Classify the organization and each recipient under the correct roles: business, service provider, contractor, or third party in California; controller or processor in Colorado.
Map sale, sharing, targeted advertising, profiling, sensitive data, and secondary uses separately.
Record exemptions at the entity, data, and processing level instead of assuming one exemption has the same reach in both states.
The official Colorado overview explains CPA scope, the Colorado-resident threshold, excluded employment data, consumer rights, consent, and universal opt-out requirements.
The enacted amendment adds the any-volume biometric-data scope route effective July 1, 2025.
2
Section 2
Which controls can be shared, and which need state-specific handling?
A single inventory, request portal, vendor register, assessment library, and opt-out service can support both laws. Reuse is defensible only when the control meets both legal definitions, deadlines, exceptions, and evidence requirements.
Keep state-specific branches where the laws diverge. Colorado requires consent before processing sensitive data and gives consumers an appeal route when a controller refuses a request. California instead provides a conditional right to limit certain uses and disclosures of sensitive personal information and uses its own request, opt-out-signal, and recipient-contract rules.
Rights workflow: support access, correction, deletion, portability, and opt-out, then add the Colorado appeal process and each state's verification or authentication rules.
Advertising workflow: honor California opt-out preference signals for sale or sharing and Colorado-recognized universal opt-out mechanisms for sale or targeted advertising.
Sensitive-data workflow: obtain Colorado consent where required; in California, determine whether the use triggers notice and the right to limit.
Contract workflow: maintain a common data-processing schedule, then include the terms required for the recipient's role under each statute and regulation.
Assessment workflow: keep processing-level facts reusable, but apply Colorado's data-protection-assessment triggers separately from California's risk-assessment rules.
Evidence: retain the legal classification, signal receipt, user-facing response, downstream propagation, exception, test result, owner, and review date.
Official Colorado overview, FAQs, rulemaking links, and universal opt-out information.
The official Colorado overview explains CPA scope, the Colorado-resident threshold, excluded employment data, consumer rights, consent, and universal opt-out requirements.
The Attorney General explains sensitive-data consent, rights methods, universal opt-out mechanisms, and controller duties.
Show 8 more
The official FAQ explains the 100,000- and 25,000-consumer routes and confirms that the count concerns Colorado residents.
The official scope explanation distinguishes Colorado's two routes.
The official FAQ states the individual-or-household limitation and employment-data exclusion.
The official Colorado materials summarize rights and methods for exercising them.
The Attorney General states the July 1, 2024 universal opt-out requirement and its application to sale and targeted advertising.
The official FAQ explains sensitive-data categories and affirmative-consent requirements.
The official overview identifies government enforcement and consumer complaint routes.
Official source for the Colorado findings and operational guidance.