CPA and browser fingerprinting

What CPA says about fingerprinting

The Colorado Privacy Act took effect on 1 July 2023 and is codified at C.R.S. §6-1-1301 through §6-1-1313. Like every state law in the 'Virginia cluster', it does not mention 'fingerprinting' by name, but C.R.S. §6-1-1303(17) defines personal data as 'information that is linked or reasonably linkable to an identified or identifiable individual'. A browser or device fingerprint hash satisfies that test the moment a controller uses it to recognise a returning Colorado consumer.

What sets Colorado apart is what came after the statute: the Colorado AG published implementing rules at 4 CCR 904-3 in March 2023, then revised them substantively in 2024 and 2025. The rules are unusually specific. Rule 2.02 explicitly names 'browser-level signals' as personal data. Rule 5.07 makes the Universal Opt-Out Mechanism the operational backbone of the opt-out right. Rule 8.01 to 8.06 spells out exactly what a Data Protection Assessment must contain. Where VCDPA leaves controllers to interpret statutory language, CPA tells them in regulator-published prose.

The practical consequence: fingerprinting compliance in Colorado is less about reading the statute and more about reading the rules. Any Benny deployment intended to serve Colorado consumers should be architected to the 4 CCR 904-3 specifications, not to the C.R.S. §6-1-1300 statutory text alone.

When CPA applies to you

Section 6-1-1304 applies the statute to controllers that conduct business in Colorado or produce products or services intentionally targeted to Colorado residents, and either (a) control or process the personal data of 100,000 or more Colorado consumers in a calendar year, or (b) derive revenue or receive a discount from the sale of personal data AND process the personal data of 25,000 or more Colorado consumers.

The second leg is where Colorado is broader than Virginia. VCDPA's 25,000-consumer leg requires more than 50% of gross revenue from selling personal data. CPA only requires any revenue from sale. A small ad-tech vendor that earns 5% of its revenue from selling fingerprint-derived audiences and processes 30,000 Colorado consumers falls inside CPA but outside VCDPA.

Consumer is defined at C.R.S. §6-1-1303(6) as a Colorado resident acting in an individual or household context. Employees and B2B contacts are excluded, matching the rest of the cluster.

The opt-out triggers and how they apply to fingerprinting

C.R.S. §6-1-1306 grants Colorado consumers five rights: access, correction, deletion, portability, and opt-out. The opt-out right divides into three categories of processing, all of which intersect with fingerprinting in ways that matter operationally.

Targeted advertising under C.R.S. §6-1-1303(25) means displaying advertisements selected based on personal data obtained from the consumer's activities over time across non-affiliated websites, applications, or online services. Recognising a returning visitor by their fingerprint and serving them ads selected from cross-site behaviour is the canonical case. First-party retargeting on your own domain, frequency capping, and contextual advertising are excluded.

Sale of personal data under CPA is defined at C.R.S. §6-1-1303(23) as the exchange of personal data for monetary or other valuable consideration by the controller to a third party. The 'or other valuable consideration' clause makes CPA's sale definition broader than VCDPA's monetary-only definition. Sharing fingerprint hashes with an ad-tech partner for mutual lift, even without a direct dollar payment, is more likely to qualify as sale in Colorado than in Virginia.

Profiling under §6-1-1303(20) covers any form of automated processing performed on personal data to evaluate, analyse, or predict personal aspects related to an individual. The opt-out applies when profiling produces 'legal or similarly significant effects'. The AG's rules at 4 CCR 904-3 Rule 9 list the qualifying decision categories: financial services, housing, insurance, education, criminal justice, employment, healthcare, and 'essential goods or services'.

Data Protection Assessments under 4 CCR 904-3 Rule 8

Rule 8 of the Colorado AG's regulations is the most detailed DPA prescription in any US state law. It requires the assessment to identify the processing activity, document the categories of personal data, name the recipients, evaluate the risks to consumers, identify mitigations, and explicitly weigh the benefits against the residual risks. The assessment must be retained for at least three years and made available to the AG on request.

For a fingerprinting deployment used to power targeted advertising, an adequate Rule 8 assessment names the signal categories collected from the device, the hash construction, the retention window, the recipients (your ad-tech partners), the de-identification claim if any, and the operational controls that honour both the on-site opt-out and the UOOM. Rule 8.05 specifically permits one assessment to cover a 'comparable set' of processing activities, which means a single assessment can defensibly cover the entire Benny deployment for the targeted-advertising flow.

The cure period is gone

CPA originally included a 30-day right to cure after the AG issued a notice of violation. Section 6-1-1311(d) terminated that right on 1 July 2025. As of that date, the AG can initiate enforcement immediately upon identifying a violation. The AG's office has publicly stated that pre-1-July-2025 violations may still benefit from cure if the controller acted promptly, but post-sunset violations are first-strike.

Practically, this changes the operational posture for Colorado deployments. There is no longer a window to fix a missed UOOM check, a missing DPA, or an unscoped fingerprint-for-targeted-ads pipeline after the AG identifies it. The 'fix it when we get the letter' compliance model that worked in 2023 and 2024 no longer applies in Colorado.

Territorial reach and the small-business question

CPA reaches any controller that conducts business in Colorado or that intentionally targets products or services to Colorado residents and meets one of the two thresholds. There is no carve-out for businesses based outside the United States; a fintech in Bangalore or a SaaS in London that meets the consumer-count threshold for Colorado consumers owes CPA obligations on that subset of its user base.

Unlike Utah's UCPA, Colorado does not exempt small businesses by revenue size. The 100,000-consumer or 25,000-with-any-sale-revenue thresholds apply equally to a 12-person startup and a 12,000-person enterprise.

How Benny the Doorman fits into a CPA-aware deployment

Benny is a fingerprinting SDK; Colorado's UOOM requirement is the architectural constraint that drives the integration shape. Three steps for a CPA-aware deployment.

First, install a GPC header check upstream of every Benny call used for targeted advertising or sale-flagged purposes. The check belongs at the application layer, not in Benny, Benny is engineered to be invoked once the controller has decided the processing is permitted.

Second, produce a Rule 8 Data Protection Assessment for each purpose listed in §6-1-1309 before going live. Benny's documentation enumerates the signal categories, the hash construction, the default retention window, and the per-call data flow, exactly the technical detail Rule 8.02 requires the assessment to capture.

Third, separate the regulated fingerprint flow from the anti-fraud flow at the architecture level. The §6-1-1306 opt-out (and the UOOM signal) must be honoured on the regulated flow without breaking the anti-fraud flow, which sits in the strictly-necessary lane and is not subject to the opt-out.