Colorado residents have strong privacy rights under the Colorado Privacy Act, including the ability to opt out of data sales, targeted advertising, and profiling. Unlike California, Colorado does not have a centralized deletion platform, so removing your information from data brokers requires a combination of browser tools, individual opt-out requests, and persistence. Here is how to take control of your personal data in Colorado.
The Colorado Privacy Act: What You Need to Know
The Colorado Privacy Act (CPA) was signed into law in 2021 and took effect on July 1, 2023. It gives Colorado residents meaningful rights over their personal data and places obligations on businesses that collect, process, and sell that data.
Under the CPA, a data broker is defined as a controller that sells the personal data of consumers with whom it does not have a direct relationship. This definition covers the vast majority of people search sites and data aggregators that profit from your personal information without your knowledge or consent.
Your Rights Under the CPA
As a Colorado resident, you have the right to:
- Access the personal data a business has collected about you
- Correct inaccuracies in your personal data
- Delete your personal data
- Obtain a portable copy of your data in a usable format
- Opt out of the sale of your personal data
- Opt out of targeted advertising
- Opt out of profiling that produces legal or similarly significant effects
Businesses must respond to your requests within 45 days. If they deny your request, you can appeal, and if the appeal is denied, you can file a complaint with the Colorado Attorney General.
No Centralized Registry
Unlike California, which created the DELETE Act and the DROP platform for centralized data broker removal, Colorado does not have a data broker registry or a single portal for deletion requests. You must contact each data broker individually or use an automated service to handle the process.
Step 1: Enable Global Privacy Control in Your Browser
One of the most powerful features of the Colorado Privacy Act is its requirement that businesses recognize Universal Opt-Out Mechanisms (UOOMs). As of January 1, 2025, all covered businesses must honor these browser-level opt-out signals.
The primary recognized UOOM is Global Privacy Control (GPC). When enabled, GPC sends an automatic signal to every website you visit telling it not to sell or share your personal data. This is the single most efficient step you can take to protect your privacy in Colorado.
How to Enable GPC
GPC is built into several privacy-focused browsers and extensions:
- Firefox: Go to Settings, then Privacy and Security, and enable "Tell websites not to sell or share my data."
- Brave: GPC is enabled by default. Verify under Settings, then Shields, then Global Privacy Control.
- DuckDuckGo Browser: GPC is enabled by default on both desktop and mobile versions.
- Browser Extensions: If you use Chrome, Safari, or Edge, install the Privacy Badger or DuckDuckGo Privacy Essentials extension, both of which support GPC.
Once GPC is active, every website you visit receives your opt-out signal automatically. Under Colorado law, covered businesses must treat this signal the same as a manual opt-out request.
GPC Has Limits
GPC only applies when you visit a website directly. It does not reach data brokers that already hold your information but whose sites you never visit. For those brokers, you need to submit individual opt-out requests.
Step 2: Identify Where Your Information Is Listed
Search for yourself on Google and on the major people search sites to see which data brokers have your information. Use your full name, city, state, and phone number as search terms. Common data brokers that list Colorado residents include:
- Spokeo
- Whitepages
- BeenVerified
- Intelius
- TruePeopleSearch
- PeopleFinders
- Radaris
- FastPeopleSearch
- Nuwber
- MyLife
Make a list of every site where your personal information appears. You will need to submit a separate opt-out request to each one.
Step 3: Submit Individual Opt-Out Requests
Each data broker has its own opt-out process. For most sites, the steps are similar:
- Find the opt-out page. Look for a "Do Not Sell My Personal Information" link, a privacy policy link, or a dedicated opt-out page, usually in the website footer.
- Locate your profile. Search for yourself on the site and copy the URL of your listing.
- Submit the removal request. Fill out the opt-out form with your identifying information and profile URL.
- Verify your identity. Most sites require email or phone verification before processing the request.
- Wait for processing. Removal times vary from 24 hours to 30 days depending on the broker.
- Check back. Confirm that your listing has actually been removed after the stated processing period.
When submitting your request, explicitly reference the Colorado Privacy Act. State that you are exercising your right to opt out of the sale of your personal data under the CPA. This puts the business on notice of its legal obligations and the 45-day response deadline.
Step 4: File a Complaint If a Broker Ignores You
The Colorado Privacy Act is enforced exclusively by the Colorado Attorney General. There is no private right of action, meaning you cannot sue a data broker directly for violating the CPA. However, the AG's office takes consumer complaints seriously and uses them to identify patterns of noncompliance.
If a data broker fails to respond to your opt-out request within 45 days or denies your request without a valid reason, you can file a complaint through the Colorado Attorney General's consumer complaint portal at coag.gov. Include copies of your original request, any responses you received, and the dates involved.
Data Reappears Constantly
Even after a successful opt-out, data brokers continuously scrape public records and purchase data from other sources. Your information can reappear on the same site within weeks. Staying protected requires ongoing monitoring and repeated opt-out requests.
The Scale of the Problem
There are over 100 data broker sites that may hold your personal information. Each requires its own opt-out form, verification process, and follow-up. A single round of manual opt-outs can take 20 to 40 hours, and because brokers re-list your data regularly, the process never truly ends. For most people, this level of ongoing effort is simply not sustainable.
Let PrivacyOn Do the Work
PrivacyOn automates data broker removal across more than 100 sites, including all the major brokers that list Colorado residents. We submit opt-out requests on your behalf, monitor for re-listings, and re-submit removal requests whenever your information reappears. Our service also includes dark web monitoring to alert you if your personal data surfaces in places that no opt-out request can reach.
Colorado's privacy law gives you real rights, but exercising them across the entire data broker ecosystem is a full-time job. PrivacyOn handles that job for you so you can enjoy the privacy the CPA was designed to provide. Family plans cover up to five people, keeping your entire household protected under one subscription.
Between GPC, individual opt-outs, and PrivacyOn's automated removal service, Colorado residents have every tool they need to take their personal data back from the brokers who profit from it.