Colorado Privacy Act

Applies at 100,000+ Colorado consumers, or 25,000+ if you derive revenue (or a discount on goods/services) from selling personal data. Unlike most peer states, Colorado does NOT exempt nonprofits generally. Biometric-specific amendments (written retention/destruction policy, consent gate) apply regardless of these thresholds. Colorado's HIPAA exemption (C.R.S. § 6-1-1304(2)) is data-level only (PHI collected/processed by a covered entity), not a whole-entity exemption. Its GLBA exemption is a genuine entity-level carve-out. The higher-education exemption is narrower than it sounds — limited to state (public) institutions, and only for data processed for noncommercial purposes; a private university or a public university's commercial activities aren't covered.