United States · Colorado
US state privacy: Colorado CPA and universal opt-out signals
A practical model for extending consent infrastructure beyond a single US state.
7 min read · 1 August 2026
A state-by-state operating model
The United States does not have one general federal privacy law equivalent to GDPR. Coverage, definitions and required interfaces differ by state, so build a rules engine around jurisdiction and processing purpose rather than cloning one banner everywhere.
The Colorado Privacy Act has applied since 1 July 2023 and includes rights to opt out of targeted advertising, sale and certain profiling.
Universal opt-out mechanisms
Colorado requires covered controllers to honour recognised universal opt-out mechanisms. The Colorado Attorney General identifies GPC as a valid mechanism.
Treat the signal as an input to the central preference service. Enforcement must reach tags, audiences, API events and downstream vendors.
Consent for sensitive data
Sensitive-data processing can require consent. This is not interchangeable with an advertising opt-out: model them as different legal actions with separate purposes, records and revocation behaviour.
Build once, configure by jurisdiction
Maintain a processing inventory, jurisdiction matrix and versioned rules. The interface should explain the rights available in the visitor’s region while preserving a consistent preference centre.
- Detect and log supported opt-out signals.
- Route requests to every relevant processing system.
- Prevent later events from silently restoring an opted-out state.
- Retest when state guidance, vendor behaviour or business purposes change.