Colorado Privacy Act and universal opt-out
In effect since July 1, 2023, for controllers that process data on 100,000 or more Colorado consumers a year, or on 25,000 or more while earning revenue or discounts from selling it. Covered businesses must honour browser opt-out signals such as Global Privacy Control, which has been required since July 1, 2024. Most small businesses fall below the thresholds. Your attorney confirms whether it applies to you.