Colorado Privacy Act: how to ask a data broker to delete your data, and what the law does not do

The Colorado Privacy Act (C.R.S. 6-1-1301 and following) took effect on July 1, 2023. Its text says a consumer "has the right to delete personal data concerning the consumer." You send the request through the methods in a company's privacy notice. The company has 45 days to answer, may extend once by 45 days, and must give you an appeal route if it refuses. Since July 1, 2024, covered companies must also honor a universal opt-out signal; the Attorney General recognizes one, Global Privacy Control, and it covers the sale of data and targeted advertising, not deletion. The law applies only to companies above its thresholds, and its definition of "personal data" excludes publicly available information, which is where many people-search listings come from. Colorado has no deletion platform and no broker registry, so removal is one request per company.

What the Colorado Privacy Act lets you ask for

Section 6-1-1306(1) of the statute lists five things a Colorado consumer may request from a covered company, which the law calls a "controller": to opt out of targeted advertising, "the sale of personal data," or profiling with "legal or similarly significant effects"; to access the data; to correct inaccuracies; to delete, in one sentence: "A consumer has the right to delete personal data concerning the consumer"; and to get a portable copy, at most twice a year. "Consumer" means "an individual who is a Colorado resident acting only in an individual or household context" (6-1-1303(6)).

The rules say what deletion means. Rule 4.06 says a controller complies by "permanently and completely erasing the personal data from its existing systems, except archive or backup systems," or by de-identifying it. Rule 4.06(D) covers a controller that got the data "from a source other than the consumer," which is what a data broker is: it complies by keeping only the minimum data needed to keep you deleted, or by "opting the consumer out of the processing of such personal data for any purpose except for those exempted." Rule 4.06(E) adds that where some data is not deleted, the controller "shall provide the consumer with the categories of personal data that were not deleted along with any applicable exception." A silent partial deletion is not what the rule describes.

How to send a request

Where. Consumers exercise their rights "by submitting a request using the methods specified by the controller in the privacy notice" (6-1-1306(1)). Rule 4.02 says a company that deals with you only online and collected the data from you may offer just an email address; any other company "shall provide two or more designated methods," one of them on its website "such as through a webform." The statute adds that controllers "shall not require a consumer to create a new account" to make a request (6-1-1306(1)).

Identity. A controller "is not required to comply" if it "is unable to authenticate the request using commercially reasonable efforts" (6-1-1306(2)(d)). Rule 4.08 sets the limits: it "shall avoid requesting additional personal data" where it can authenticate with what it holds, "shall not require the consumer or authorized agent to pay a fee for authentication," and if it cannot authenticate you must "provide information on how to remedy any deficiencies." We do not send ID documents to brokers.

The clock. The controller "shall inform a consumer of any action taken on a request" "within forty-five days after receipt," may extend "by forty-five additional days where reasonably necessary," and must give "the reasons for the delay" within the first 45 days. The first request in a year is free; the Attorney General's FAQ says a second may cost "25 cents per page or no more than the actual cost."

Denial and appeal. A controller that does not act must give "the reasons for not taking action and instructions for how to appeal" (6-1-1306(2)(b)). Rule 4.09(C) lists the grounds: a conflict with federal or state law, an exemption under 6-1-1304(2) with "a description of the exception," inability to authenticate, impossibility, or a documented belief that the request is "fraudulent or abusive." The appeal process must be "as easy to use as the process for submitting a request" (6-1-1306(3)); the controller has 45 days to answer "along with a written explanation of the reasons," extendable by 60 days, and "shall inform the consumer of the consumer's ability to contact the attorney general if the consumer has concerns about the result of the appeal." The Attorney General's complaint page has a "Data Privacy | Data Breach" category; the same page says the office "does not have the authority to investigate or prosecute your individual case."

A note for services like ours. The statute's text on authorized agents sits in the opt-out paragraph: a consumer "may authorize another person, acting on the consumer's behalf, to opt out." The deletion paragraph does not mention agents, and we do not claim the statute settles how a broker must treat a request sent on your behalf.

The universal opt-out signal

Section 6-1-1313(2) told the Attorney General to adopt rules for "universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data." Section 6-1-1306(1)(a)(IV)(B) says that "effective July 1, 2024," a controller that sells data or targets ads "shall allow consumers to exercise the right to opt out" that way.

Rule 5.07 says the Department of Law "shall maintain a public list" of recognized mechanisms. That list is the Attorney General's universal opt-out page. It says Global Privacy Control "was the first UOOM to be recognized" and that "currently, GPC is the only UOOM considered valid by The Department." It describes GPC as "a signal sent by an internet user's web browser," set as "a setting or extension in the user's browser or mobile device," and adds: "If you have multiple devices or browsers, you will need to turn on GPC for each one separately." The GPC site lists participating browsers and extensions.

What the signal does, per Rule 5.02: it expresses a choice to opt out of "targeted advertising and sale of personal data," or one of the two, and Rule 5.08 says a controller "shall treat such as a valid request to opt out" "for the associated browser or device, and, if known, for the consumer." What it does not do: it is not a deletion request; nothing in Part 5 or 6-1-1313 mentions deletion. It reaches the sites you visit with that browser, so a broker whose website you never open does not receive it. It stops the sites you use from selling what they collect going forward. It does not take down a listing.

Who is covered and who is not

Thresholds. Section 6-1-1304(1) applies the law to a controller that does business in Colorado or targets its residents and either "controls or processes the personal data of one hundred thousand consumers or more during a calendar year," or "derives revenue or receives a discount on the price of goods or services from the sale of personal data and processes or controls the personal data of twenty-five thousand consumers or more." The Attorney General's FAQ says 100,000 means Colorado residents.

Publicly available information. Section 6-1-1303(17) says personal data "does not include de-identified data or publicly available information," meaning "information that is lawfully made available from federal, state, or local government records and information that a controller has a reasonable basis to believe the consumer has lawfully made available to the general public." Property, court and voter records are government records, and many people-search profiles are assembled from them. Whether a given listing is inside or outside the definition is for the text and the Attorney General to decide. Expect a broker to cite this clause in a denial, and expect Rule 4.06(E) to require it to name the categories it kept.

Exemptions. Section 6-1-1304(2) leaves out, among others, protected health information under HIPAA, "creditworthiness" data "to the extent that the activity is regulated by" the Fair Credit Reporting Act, data and institutions under the Gramm-Leach-Bliley Act, data under the Driver's Privacy Protection Act, COPPA and FERPA, and "data maintained for employment records purposes."

No registry, no platform. The Attorney General's pages we read describe no data broker registry and no central deletion mechanism. The route is one request per company; our data broker directory and people-search list exist to shorten that list.

Amendments since 2023. The Attorney General's rulemaking page lists SB 24-041 (minors' data, signed May 31, 2024) and SB 25-276 (precise geolocation as sensitive data, signed May 23, 2025); the legislature's page for HB 24-1130, effective July 1, 2025, adds a written retention and deletion policy and consent requirements for biometric identifiers. None of them changes the request process above, as far as the pages we read show.

Colorado vs California

California's Delete Act gave that state a broker registry and DROP, a free one-request deletion platform for registered brokers; see California's Delete Act and DROP. Colorado has neither: it has per-company rights, one recognized browser signal, and the Attorney General plus district attorneys as sole enforcers (6-1-1311). Under both, a broker may keep publicly available data. A Californian submits one form; a Coloradan sends one request per broker and keeps a spreadsheet.

Practical order

1. Turn on Global Privacy Control in every browser and device you use. Expect it to stop sale and ad targeting by sites you visit, nothing more.
2. Search your name with your city and list every site that shows you. How to remove your information from the internet has the inventory method; What is a data broker explains who these companies are.
3. Send a deletion request to each one through the method in its privacy notice. State that you are a Colorado resident, say "delete," and ask for the categories kept and the exception relied on (Rule 4.06(E)). Note the date.
4. Mark 45 days, 45 more on an extension notice, and 45 again after an appeal. If the appeal fails, file a complaint in the Data Privacy category with the dates and the refusal text.
5. Re-check your name after 90 days. Rule 4.06(C) lets backup copies wait until the system is next accessed, and a listing built from public records can be rebuilt. A fresh search is the only proof that matters.

If you are at risk

If you are dealing with stalking, harassment or a threat to your safety, a 45-day statutory clock is not a safety plan. Contact local law enforcement or a victim advocate first; they can also tell you about Colorado's address confidentiality program.

FAQ

Does the Colorado Privacy Act let me delete my data from people-search sites? The statute lists a right to delete personal data, but its definition of personal data excludes publicly available information: government records and data you made public yourself. Many people-search listings come from such records. Send the request anyway; a company that refuses must give its reasons and an appeal route.

How long does a company have to answer a Colorado deletion request? The statute says a controller must inform the consumer of any action taken within 45 days of receipt. It may extend by 45 more days where reasonably necessary, and must give the reasons within the first 45 days.

Does Global Privacy Control delete my data in Colorado? No. The CPA rules say a universal opt-out mechanism expresses a choice to opt out of targeted advertising, the sale of personal data, or both. It is a browser signal sent to sites you visit, not a deletion request, and it does not reach a site you never open.

Can I sue a data broker under the Colorado Privacy Act? No. The statute says the Attorney General and district attorneys have exclusive authority to enforce it and that nothing in it provides a private right of action. The consumer's route is a complaint to the Attorney General's office.