Colorado Privacy Act Requirements for Google Analytics Users

The Colorado Privacy Act (CPA), effective July 1, 2023, is the strictest of the “second wave” state privacy laws when it comes to one specific requirement that matters directly for Google Analytics 4: it was the first US state law to make honoring a universal opt-out mechanism, in practice, Global Privacy Control, a hard legal requirement rather than a best practice.

Who the CPA applies to

The Colorado Privacy Act applies to businesses that conduct business in Colorado or produce products or services targeted to Colorado residents, and either:

• Control or process personal data of 100,000+ Colorado consumers per calendar year, or
• Control or process personal data of 25,000+ Colorado consumers and derive revenue (or a discount on goods/services) from the sale of personal data.

Like Virginia’s CDPA, there’s no separate revenue floor, so mid-size sites with meaningful Colorado traffic can be in scope.

The requirement that sets Colorado apart: mandatory universal opt-out

Most state privacy laws mention universal opt-out mechanisms like GPC as something businesses may honor, or treat it as satisfying an opt-out request if a business chooses to support it. Colorado’s implementing regulations went further: businesses subject to the CPA must recognize and honor a universal opt-out signal for opt-out of targeted advertising and sale, starting July 1, 2024. This isn’t optional for in-scope Colorado businesses the way it functionally is in some other states.

For a GA4 implementation, that has one direct consequence: if you have Colorado traffic and meet the thresholds, your consent setup needs to actively detect and respond to GPC signals, disabling Google Signals and any ads-linked GA4 features for visitors who send one, without requiring them to click anything else. We walk through the technical implementation in our GPC and GA4 guide.

What else the CPA requires

• Opt-out rights for targeted advertising, sale, and profiling, defined similarly to Virginia’s CDPA, meaning a standard Google Signals + Ads Linking setup is likely in scope regardless of whether money changes hands.
• Data protection assessments for processing that presents a heightened risk, including targeted advertising, before you undertake it, an internal documentation requirement, not a visitor-facing one.
• Purpose and disclosure requirements, your privacy policy needs to state the categories of personal data processed and the purposes, including any advertising-related use of Analytics data.
• Right to opt out of profiling used for decisions with legal or similarly significant effects, less directly relevant to typical GA4 use but worth confirming your setup doesn’t cross into automated decision-making territory.

Practical checklist for Colorado-facing GA4 setups

1. Confirm whether you meet the 100,000 or 25,000-consumer threshold for Colorado traffic specifically.
2. Verify your consent tooling detects GPC and suppresses Google Signals/ads personalization in response, don’t assume a generic “Do Not Sell” link covers this.
3. Update your privacy policy to describe targeted advertising and profiling in Colorado-specific terms, not just California’s “sale” language.
4. If you run any GA4-driven personalization with legal or similarly significant effects (rare for most sites, but worth ruling out), confirm you’re not triggering the profiling opt-out unintentionally.

This guide is educational and not legal advice. Colorado’s implementing regulations continue to be refined by the Colorado Attorney General’s office; confirm current requirements with a privacy attorney.