Affirmative
A deliberate action or clear statement. Silence, continued browsing, prechecked boxes, and bundled terms do not qualify.
PRIVACY, MADE VISIBLE
Colorado consent
Choose an activity. Check the rules for the data and the person.
START WITH SCOPE
This guide assumes a covered controller and nonexempt personal data of Colorado consumers. Check coverage, HIPAA-related data exclusions, and § 6-1-1304(3)–(5) exceptions first. [1]
Hover over or tap a marked term for its definition, or a statute citation for the legal text. With a keyboard, focus the control and press Enter or Space. Press Esc or tap elsewhere to close.
Goofus & Gallant
Two lemonade-delivery founders. Enable JavaScript to try their fictional apps, or use the consent guide below.
01
THE CONSENT TRIGGER
Do you need consent?
Explore the rule below.
The rest of the guide stays in view.
Choose an activity to check the requirement.
The interactive guide needs JavaScript. For sensitive data, consent generally comes first. Ordinary sales, targeted advertising and significant-decision profiling generally carry opt-out rights. Minors and particular data types have additional consent requirements or prohibitions. The sources below set out the differences.
Assumes a covered controller and nonexempt data. These are hypothetical choices; no personal information is requested. Hover over or tap underlined terms and citations for the source text. With a keyboard, focus the control and press Enter or Space.
02
THE CONSENT STANDARD
How to ask for consent
All five elements must hold.
A click alone is not consent. [6]
Freely given
Allow refusal without detriment and easy withdrawal. Do not condition a contract on unnecessary data use. Necessity and qualifying loyalty programs have limited exceptions.
Specific
Allow separate choices for purposes that are not reasonably necessary to or compatible with one another. A sale to a different sensitive-data buyer is a distinct purpose.
Informed
Identify the controller, why consent is required, the purposes, data categories, named sensitive-data buyers, and how and where to withdraw. Add applicable loyalty/profiling disclosures.
Unambiguous
Make the choice clear. Agreement obtained through a dark pattern is not valid consent.
CHOICE ARCHITECTURE
Make refusal as easy as agreement
No defaults, guilt, fake urgency, or repeated disruptive prompts. Keep the ask prominent, concise, accessible, and separate from unrelated terms. [7]
LAYERED DISCLOSURES
Link to the specific disclosure
If disclosures are linked, identify the exact heading and section; link directly there when feasible. Put identity, reason, purposes, and data categories in the interface where possible. [7]
03
THE CONSENT LIFECYCLE
Changes and withdrawal
Permission has a scope.
Build for change from the beginning.
Refusal or withdrawal
Do not begin, or cease, that processing. Make refusal or withdrawal as easy and within a similar number of steps as consent. If obtained electronically, use the same or a similar electronic interface.
On withdrawal, give deletion-right instructions, a link, or a privacy-notice pointer in the required response. Sensitive data should then be deleted, permanently anonymized, or made inaccessible within a reasonable time. [8]
Use for a new purpose
If the purpose materially evolves into one not reasonably necessary to or compatible with the original purpose, the original consent no longer covers it.
Obtain new consent before that use, and update related notices and documentation. [9]
Consent after 24 months without interaction
Refresh consent after 24 months without consumer interaction for sensitive data and for secondary uses involving profiling in furtherance of decisions that produce legal or similarly significant effects.
The exception: Rule 7.08(B) exempts this refresh where the consumer can access and update opt-out preferences at any time through a user-controlled interface. [10]
A new buyer or a prior opt-out
Identify and obtain consent for a new sensitive-data buyer.
If the consumer opted out of sale, targeted advertising, or covered profiling, apply the separate opt-back-in rules too. Avoid schemes that cause consent fatigue. [11]
FOLLOW THE AUTHORITY
Sources
Every branch has a source.
“Rules” means 4 CCR 904-3.
Coverage first
C.R.S. §§ 6-1-1303(1), (6), (17); 6-1-1304(1)–(5). Coverage and exemptions are prerequisites, not fully mapped here.
Sensitive data & processing
§§ 6-1-1303(18), (24); 6-1-1308(7). Rules 2.02 (“Sensitive Data Inferences”), 6.10(A), 7.02(A)(1).
The inference exception
Rules 6.10(B)–(C), 6.03(A)(5), 7.02(C). All four conditions are required. The consumer must be over 13; a 13-year-old does not qualify.
The exception does not excuse separately regulated source data or independent consent duties. The privacy notice must describe the inference and its retention/deletion timeline; the assessment must detail deletion and verification.
Previously collected data
Rule 7.02(B)–(B)(2). Pre-July 2023 consent must meet the rules. The transition deadline for continued sensitive-data processing was July 1, 2024.
Other duties continue
§§ 6-1-1308(2)–(6), 6-1-1309; Rules 6.06–6.09, 7.02(A), Part 8. Consent does not replace purpose limits, minimization, security, nondiscrimination, or required data protection assessments.
Valid consent
§ 6-1-1303(5), (9); Rule 7.03(A)–(F), especially (D)(1)–(3) and (E)(1)(a)–(g).
Interface & disclosures
Rules 3.02(A), 7.04(A)–(D), 7.10(A), (C)–(F). Dark-pattern requirements appear in Rule 7.10, formerly Rule 7.09.
Refusal & withdrawal
Rules 7.07(A)–(E), 6.07(B)(3); § 6-1-1308(1)(c)–(d). Withdrawal and a deletion request are distinct.
Changed purposes
§ 6-1-1308(4); Rules 6.04(B), 6.06(D), 6.08, 7.08(C).
Refreshing consent
Rule 7.08(A)(1)–(2), (B). The user-controlled preference interface exception applies to this inactivity-based refresh.
New buyers & opt-back-in
Rules 7.03(D)(3), (E)(1)(e), 7.02(A)(3), 7.05; § 6-1-1306(1)(a). For sale and targeted advertising, honor qualifying universal opt-out mechanisms. A controller-specific consent exception has its own conditions and does not apply to other controllers.
Ordinary data: consent and opt-out are different
§ 6-1-1306(1)(a); § 6-1-1308(3), (4), (7). Ordinary data used for the disclosed or compatible purpose has no general prior-consent trigger. Sale, targeted advertising and covered profiling carry opt-out rights. Rule 9.04(B)–(D) distinguishes meaningful human involvement from solely automated or superficially reviewed profiling; the opt-out method and response disclosures remain important. A prior opt-out requires the Rule 7.05 opt-back-in process. Changes to purpose and sensitive data can independently require consent.
Minors and online services
§ 6-1-1308.5(2)–(4). For known or willfully disregarded minors under 18, specified online activities require the minor’s consent, or parental consent for a child under 13. These include sale, targeted advertising, significant-decision profiling, incompatible purposes, excessive retention and features extending use. Educational services have a limited exception; location and direct-messaging safeguards need separate attention. A known child’s personal data is sensitive data under § 6-1-1303(24)(c).
Biometrics, neural data and location
§ 6-1-1303(2.2), (2.4), (2.5), (16.7), (17.4), (24); § 6-1-1314(4). These data types have specific definitions. Biometric identifiers require a notice and retention safeguards. Selling, leasing or trading identifiers is prohibited; disclosure has specified exceptions. Biological data includes neural data and is sensitive data. Precise geolocation is sensitive too.
Employee biometric data
§ 6-1-1314(6); Rule 7.09. Employment is generally outside the consumer definition, but this biometric provision expressly reaches employees. Consent may be required as a condition of employment only for the specified access, timekeeping, or workplace safety/security purposes. Other uses generally require a voluntary choice without retaliation; subsection (6)(d) addresses existing reasonable role expectations. Use the provision’s exact conditions, not the ordinary consumer flow.
Scope, edition & source notes
This educational guide follows the assigned Week 6 reader’s Colorado statute and rules: the statute through 2025 and rules identified there as effective December 1, 2025. Rule 6.10 and omitted provisions were checked in the official CCR text linked above, whose amendment history runs through January 30, 2025.
Tooltip definitions are plain-language summaries of C.R.S. § 6-1-1303 (2025), with the specific subsection shown in each tooltip. Health-inference definitions come from Rule 2.02 and are labeled accordingly. It is a course-material snapshot, not a representation that every later amendment is included. The flow includes ordinary and sensitive data, minors’ online services, biometrics, biological/neural data, location and opt-outs. Employment biometrics have a separate source note. The 2025 statute’s biometric sale prohibition controls over any broader wording in the older rules. Coverage and exemptions require separate review. No personal details are requested by the exploratory controls.