In forceLegalIn force 1 Jul 2024

Colorado GPC stops sale and cross-site targeting, not ordinary email

Q: What must Colorado controllers do with Global Privacy Control?

Colorado recognises GPC as a universal opt-out mechanism that covered controllers must honour for (1) sale of personal data and (2) processing for targeted advertising. Colorado rules state controllers are not obligated to honour the signal for other purposes. The signal applies to the browser or device, with authenticated expansion to the consumer when identity is known. It is not an ordinary first-party email marketing kill switch unless you choose to treat it as one.

Q: In plain English?

Colorado’s privacy rules treat Global Privacy Control as an opt-out of sale and targeted ads. Marketing email is a separate channel unless your policy or tooling maps GPC into suppressions. Honour GPC where the law points; do not invent an email ban you never promised — or ignore ad-side duties you do have.

What must Colorado controllers do with Global Privacy Control?

Colorado · United States

In one sentence

In Colorado, a signal means stop sale and stop targeted advertising — not automatic newsletter deletion unless you designed that.

Plain English

Colorado’s privacy rules treat as an of sale and targeted ads. Marketing email is a separate channel unless your policy or tooling maps GPC into suppressions. Honour GPC where the law points; do not invent an email ban you never promised — or ignore ad-side duties you do have.

Why it matters. Same trap as California: wrong team owns the signal, wrong system gets wired.

Dotted words open definitions. Full glossary.

What to do

Your move — not a lecture

Part platform, part you

The platform covers the mechanical bit. The judgement is still yours.

CMPs can detect the signal. suppression is a custom integration, not a default.

Your part: Scope decisions, privacy notice text, and testing the full data path.

What to do first

Read your privacy notice's universal section. If it claims email stop on , verify the path today.

You can skip this if: You are outside Colorado Privacy Act thresholds and do no sale or targeted advertising.

Who this applies to

Controllers in scope of the Colorado Privacy Act that sell data or run targeted advertising.

Checklist

01Honour for sale and targeted advertising from 1 July 2024 onward.
02Do not invent duties for purposes Colorado says are out of scope.
03Document whether email is intentionally linked; default is that it is not required.

That’s enough to act. Sources and exact wording are below for counsel, bosses, or AI tools that need a citation. Not legal advice.

Proof

Exact position, enforcement, sources

For records and people who will check you. Skip if Monday’s move is already clear.

The exact position

Colorado recognises as a universal mechanism that covered controllers must honour for (1) sale of personal data and (2) processing for targeted advertising. Colorado rules state controllers are not obligated to honour the signal for other purposes. The signal applies to the browser or device, with authenticated expansion to the consumer when identity is known. It is not an ordinary first-party email marketing kill switch unless you choose to treat it as one.

What happens if you do not

Colorado AG enforces the CPA. As with California, the live risk is non-honoured sale/targeting opt-outs, not a special email-only fine.

Sources

Colorado Attorney General, Universal Opt-Out
No publisher dateRead primary source
Colorado Privacy Act overview
No publisher dateRead primary source

California GPC opts out of sale and sharing, not marketing emailIn force

History of this page

2 Aug 2026Added with US-CO jurisdiction.

Awkward questions

Who is this actually for?

People who ship email and are too busy to re-read every PDF: week-one marketers, lifecycle/CRM, deliverability, multi-country ops, DTC brands, agencies — on Klaviyo, Mailchimp, Braze, HubSpot, SFMC, or something else. Pick your tool and geos so product-specific pages only appear when they match. EU and UK are first-class filters. Not for people who sell tools about email and need a fake score to demo.

Why only ~40 rules? Isn’t that… thin?

On purpose. A wall of 400 undated “best practices” is how you look busy and still get burned. Every page needs a primary source we actually read. Thin and checkable beats fat and folklore. Europe, bulk inbox rules, measurement honesty, and protocol topics like BIMI/DMARC policy are on the shelf when we can cite them — not every Member State and not every vendor myth. Coverage map lists what we still refuse to invent.

Is this legal advice?

No. If it were, you’d have a billable hour and a longer PDF. This is a dated operator reference written by an email geek. Confirm anything high-stakes with counsel who knows your facts. Same for “will this make me compliant?” — no tool does that. Lawyers and judges do. We say what the sources say and what to do first on Monday.

Why no trust score out of 100?

Because we refuse to invent a number you can’t audit. Fake scores sell seed tests and panic. You get findings, dates, and links. If that feels less exciting than a red dial, good — you’re not the red-dial customer.

Why should I trust you more than my ESP’s blog?

ESPs sell seats. Seed-score vendors sell fear. AI invents citations when nobody watches. We sell nothing today — no pixels, no placement scores, no affiliate — so we can say when a tool is the problem. A human verifies, dates, and corrects in public. Tools may help draft; they do not ship unsourced claims. Check the primary links. Fail that test and leave.

Do I need an account?

No. Filters live in this browser and the URL. Share the link. That’s it. Accounts come later only if they earn it — not so we can nurture you about email.

I’m an agency. Where’s multi-client mode?

We tried a client-name CRM on the setup card. It made the product feel like work before it felt useful. Role filters + copy link + one-page brief (optional PDF title) is enough for now. Complexity comes back when the free shelf is habit, not before.

Is the quiet changelog a bug?

No. Quiet means nothing material moved. We don’t invent urgency so the homepage looks “alive.” Sticky risks still show what usually needs a person when the market is still.