DataTrail Join the waitlist

State privacy laws / Colorado

Your right to delete your data in Colorado

Colorado's CPA lets residents make many companies delete the personal information they hold. Here's what the law covers and how to use it.

Last checked October 2026

The lawCPA
In effect sinceJuly 2023
Response deadline45 days

Quick answer

If you live in Colorado, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.

Your rights under the CPA

The Colorado Privacy Act (CPA) gives Colorado residents the right to:

What makes Colorado's law stand out

Colorado was one of the first states to require covered companies to honor recognized universal opt-out mechanisms, such as the Global Privacy Control setting available in some browsers. When you turn on a recognized signal, covered websites must treat it as your request to opt out of targeted advertising and the sale of your data, so you don't have to fill in a form on every site.

Colorado's law also covers nonprofits, and the Attorney General has written detailed rules that spell out how companies must handle requests.

Which companies have to comply

Companies and nonprofits doing business in Colorado that handle the personal information of at least 100,000 Colorado residents a year, or that earn money or discounts from selling personal information and handle the information of at least 25,000 residents.

That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.

How to ask a company to delete your data

  1. Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
  2. Ask the company to delete your personal information, and say that you're a Colorado resident making the request under the CPA.
  3. Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
  4. Write down the date you sent the request. You'll need it if the company misses its deadline.

How long companies have to respond

Companies must respond within 45 days. They can take up to 45 more days when reasonably necessary, as long as they tell you.

If a company ignores or refuses your request

If a company refuses your request, it has to offer a way to appeal. If the appeal is denied too, you can file a complaint with the Colorado Attorney General.

Make your requests in minutes, not evenings

The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the CPA, and tracks the 45-day deadline for you. You review each one and send it from your own email.

Join the waitlist

Enforced by the Colorado Attorney General and district attorneys. This page is general information, not legal advice, and laws change. For the official text, see Colorado's state legislature or Attorney General website.