CPA requirements
Colorado's law has been in force since July 1, 2023 and is one of the stricter state regimes in practice. Since July 1, 2024 controllers must honor universal opt-out mechanisms, and the Attorney General has recognized the Global Privacy Control, so a GPC signal received by a Colorado consumer's browser must stop targeted advertising and sale. The cure period expired at the start of 2025. Amendments effective in 2025 added protections for minors and treated biometric identifiers separately. The Attorney General and district attorneys enforce, with penalties of up to $20,000 per violation under Colorado's consumer protection statute. For a marketing or privacy team the test is simple to state and hard to prove without evidence: when GPC is on, do the advertising pixels actually stay quiet?
CPA articles and analysis
Cookie Compliance in 2026: Why Consent Banners Don’t Prevent Enforcement Actions
Consent banners alone do not guarantee cookie compliance. Regulators now focus on actual third-party data flows, tracking pixels, cookie syncing, fingerprinting, and unauthorized data sharing....
Read More
IAB Multi-State Privacy Agreement (MSPA) Update 2026: What Advertisers Need to Know
A report out of Carnegie Mellon’s School of Public Policy found that “87% (216 million of 248 million) of the population in the United States...
Read More
U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026
2026 is a turning point in U.S. privacy regulation: multiple new comprehensive state laws go live, enforcement provisions activate, and novel mechanisms (like the California...
Read More
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.