What's the Consumer Threshold for Colorado's Privacy Act to Apply to a Business?

The Colorado Privacy Act (CPA) applies to a business once it controls or processes the personal data of 100,000 or more Colorado consumers in a calendar year, or 25,000 or more consumers if the business derives revenue — or a price discount — from selling that data. Unlike the CCPA, there's no standalone gross-revenue figure that triggers coverage on its own.

Two Thresholds, Not One

The CPA sets up two separate ways a business gets pulled into scope, and either one is enough on its own:

• The volume prong: Controlling or processing the personal data of 100,000+ Colorado consumers in a calendar year, regardless of whether any of that data is ever sold.
• The sale prong: Controlling or processing the data of at least 25,000 Colorado consumers while also earning revenue, or a discount on goods or services, from selling personal data.

Both prongs require the business to also conduct business in Colorado or intentionally target goods or services to Colorado residents — simply having some Colorado visitors by accident doesn't trigger the law.

Why "No Revenue Threshold" Matters for Marketers

Several comprehensive state privacy laws, including California's, use a company-wide gross-revenue figure (commonly $25 million) as one trigger for coverage. Colorado skips that approach entirely — a small business with modest revenue but a large enough Colorado audience, such as a regional e-commerce brand or a lead-gen site with heavy Colorado traffic, can fall inside CPA's scope even while sitting well under CCPA's revenue bar. The reverse is also true: a company that clears CCPA's revenue threshold but reaches relatively few Colorado residents may sit outside CPA's reach entirely.

What "Consumer" Excludes

The CPA defines "consumer" as a Colorado resident acting in an individual or household context — not someone interacting with a business in an employment or B2B capacity. That carve-out means a marketing agency's Colorado-based client contacts, collected in a B2B sales capacity, generally don't count toward either threshold the way a consumer email list would.

The Cure Period Is Gone, and Penalties Are Real

Colorado originally gave businesses a 60-day window to fix a violation before facing enforcement, but that cure period sunset on January 1, 2025 — regulators can now act on a violation without offering a chance to correct it first. CPA violations are treated as deceptive trade practices under the Colorado Consumer Protection Act, with penalties running up to $20,000 per violation and a $500,000 cap for a related series of violations; that per-violation maximum rises to $50,000 when the deceptive practice targets a consumer over 60.

Bottom Line

Count your Colorado-specific consumer volume, not your company-wide revenue, to know whether the CPA applies — and if you're anywhere near 25,000 Colorado consumers and monetize data in any way, check the sale-prong trigger specifically, since it catches businesses well before the 100,000-consumer volume threshold would.

Sources: Colorado Privacy Act, C.R.S. §§ 6-1-1301 to 6-1-1313, as summarized in legal analyses from Foley & Lardner ("Colorado Joins California and Virginia in Passing a Comprehensive Privacy Law," foley.com), Baker Donelson's Colorado consumer data privacy law guide (bakerdonelson.com), and Captain Compliance, "Colorado's Privacy Enforcement Heats Up: What the GPC Sweep and End of 'Cure' Period Mean for Your Business" (captaincompliance.com).