The Colorado Privacy Act (CPA) states that any consumers that are residents of Colorado or that have their data held by a qualifying Colorado based data broker company may request deletion of their data. The data broker must inform the consumer of any action taken without undue delay, and within 45 days. When reasonably necessary, the data broker can extend the response time for an additional 45 days if they provide a reason to the consumer and notify them within the original 45 day time frame. If the data broker declines to delete the data, they must provide a reason and a process for appeal. The data broker must provide a response to the appeal within 45 days, or extend the response time for an additional 60 days by notifying the consumer within the original 45 day period and providing a reason. The data broker must inform the consumer of their ability to contact the attorney general with any concerns with the result of the appeal.

Colorado Resident Sample Email:

Dear [company name],

I am submitting a request for implementation of the following rights under 6-1-1306(1)d of the Colorado Colorado Privacy Act which grant Colorado residents certain rights in relation to protection of their personal data information:

1) To obtain erasure (deletion) of personal data (information) without undue delay;
2) To withdraw any consent given to the processing of personal data (information);
3) To object to processing of personal data (information) concerning the below individual, including but not limited to profiling and direct marketing.

I can be identified by my details below:

Name:
Address:
E-mail address:

Please confirm your compliance with the request without undue delay and in any event within 45 (forty five) days of receipt of this request.

Thank you,

COLORADO PRIVACY ACT

6-1-1306. Consumer personal data rights – repeal.
(1) CONSUMERS MAY EXERCISE THE FOLLOWING RIGHTS BY SUBMITTING A
REQUEST USING THE METHODS SPECIFIED BY THE CONTROLLER IN THE
PRIVACY NOTICE REQUIRED UNDER SECTION 6-1-1308
(a) Right to opt out. (I) A CONSUMER HAS THE RIGHT TO OPT OUT
OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR
PURPOSES OF:
(A) TARGETED ADVERTISING;
(B) THE SALE OF PERSONAL DATA; OR
(C) PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL
OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER.
(b) Right of access. A CONSUMER HAS THE RIGHT TO CONFIRM
WHETHER A CONTROLLER IS PROCESSING PERSONAL DATA CONCERNING THE
CONSUMER AND TO ACCESS THE CONSUMER’S PERSONAL DATA.
(c) Right to correction. A CONSUMER HAS THE RIGHT TO CORRECT
INACCURACIES IN THE CONSUMER’S PERSONAL DATA, TAKING INTO ACCOUNT
THE NATURE OF THE PERSONAL DATA AND THE PURPOSES OF THE PROCESSING
OF THE CONSUMER’S PERSONAL DATA.
(d) Right to deletion. A CONSUMER HAS THE RIGHT TO DELETE
PERSONAL DATA CONCERNING THE CONSUMER.