--- title: "Colorado Privacy Act Checks for Real Estate Agent Websites" description: "Check Colorado Privacy Act thresholds, exceptions, inquiry data, privacy requests, and vendor controls before briefing your agent website builder." canonical: "https://scalewithsearch.com/articles/colorado-privacy-act-agent-website-check" --- ## Site navigation - [Scale With Search](https://scalewithsearch.com/) - Services - Services - [AI systems](https://scalewithsearch.com/ai-systems) - [Site build](https://scalewithsearch.com/work#site-build) - [Whole website fix](https://scalewithsearch.com/work#whole-website-fix) - [Content library with SEO](https://scalewithsearch.com/work#content-library) - [Working session](https://scalewithsearch.com/audit) - Start here - [Send your brief](https://scalewithsearch.com/work#send-your-brief) - [Example scope](https://scalewithsearch.com/work#review-the-example-scope) - [Prices and terms](https://scalewithsearch.com/work#prices-and-terms) - Industries - Real estate - [Real estate agents and teams](https://scalewithsearch.com/for/real-estate) - [Platforms, ownership, and IDX](https://scalewithsearch.com/for/real-estate/real-estate-website-platforms-ownership-idx) - [Search, content, and AI](https://scalewithsearch.com/for/real-estate/real-estate-search-content-ai) - [Inquiries, campaigns, and handoffs](https://scalewithsearch.com/for/real-estate/real-estate-website-inquiries-campaigns-handoffs) - [Buyer, seller, and local pages](https://scalewithsearch.com/for/real-estate/real-estate-buyer-seller-local-resources) - [Rules, privacy, and trust](https://scalewithsearch.com/for/real-estate/real-estate-website-rules-privacy-trust) - Browse by business - [Trades and home services](https://scalewithsearch.com/for/#group-trades) - [Health, wellness, and animal care](https://scalewithsearch.com/for/#group-practices) - [Law, finance, and IT](https://scalewithsearch.com/for/#group-professional) - [Marketing and SEO agencies](https://scalewithsearch.com/for/#group-agencies) - [Shops and manufacturers](https://scalewithsearch.com/for/#group-manufacturing) - [Restaurants, shops, studios, and nonprofits](https://scalewithsearch.com/for/#group-local-services) - Chiropractic practices - [Chiropractic and wellness practices](https://scalewithsearch.com/for/chiropractic-and-wellness-practices) - [Chiropractic and physical therapy clinics](https://scalewithsearch.com/for/chiropractic-and-physical-therapy-clinics) - [All industries](https://scalewithsearch.com/for/) - Resources - Free tools - [AI readiness check](https://scalewithsearch.com/check) - [Free tools](https://scalewithsearch.com/tools/) - [Free Starter Kit](https://scalewithsearch.com/kit/business-memory-starter-kit.zip) - Guides - [AI-native library](https://scalewithsearch.com/ai-native) - [Industry intelligence](https://scalewithsearch.com/intelligence) - [Office job guides](https://scalewithsearch.com/guides/) - [Business memory](https://scalewithsearch.com/articles/business-memory-for-ai-agents-guide) - [Agent governance](https://scalewithsearch.com/articles/ai-agent-governance-guide-small-business) - [Migration and ownership](https://scalewithsearch.com/articles/leaving-vendor-ai-memory-guide) - Articles - [All articles](https://scalewithsearch.com/articles/) - [What changed](https://scalewithsearch.com/changes/) - About - Evidence - [Proof](https://scalewithsearch.com/proof) - Scale With Search - [About](https://scalewithsearch.com/about) - [How it works](https://scalewithsearch.com/how-it-works) # Colorado Privacy Act: check your real estate agent website A typical solo agent or small team likely falls below the Colorado Privacy Act's general thresholds. This is an inference from the thresholds, not a finding about your business. Verify annual consumer counts and sale-related transfers before relying on that assumption. Biometric processing and specified protections for minors need separate review even below the usual thresholds. [C.R.S. § 6-1-1304, 2026 statutes, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Start with a dated applicability decision from counsel. Then inspect the seller form, buyer inquiry, listing search, and services receiving their data. The checks below are proposed website acceptance requirements. This article is general information, not legal advice. Confirm applicability, exceptions, and required controls with counsel. Scale With Search builds websites and AI systems. It does not provide compliance, consent, or legal services. ## Check the business behind the website The general test covers a controller conducting business in Colorado or delivering commercial products or services intentionally targeted to Colorado residents. It also requires either threshold below. A controller determines the purposes and means of processing, alone or jointly. [C.R.S. §§ 6-1-1303(7), 6-1-1304(1), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). | General threshold | What to establish before deciding | | --- | --- | | Controls or processes personal data of **100,000 or more consumers during a calendar year** | The entity's annual consumer count and the processing included | | Derives revenue or receives a discount from selling personal data, and controls or processes data of **25,000 or more consumers** | Both the sale-related consideration and the consumer count | Source: [C.R.S. § 6-1-1304(1)(a)(I), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). These tests do not contain California's annual gross-revenue threshold. Do not substitute property sales volume or commission income for the Colorado consumer-count tests. Give counsel the agent business, team company, brokerage, form accounts, and vendor agreements. Ask which entity controls each processing activity. Prepare counts across that entity's relevant operations, including offline records. Do not equate form submissions, closed transactions, or page views with distinct covered consumers. The CPA consumer definition covers Colorado residents acting in an individual or household context. It excludes commercial and employment contexts, including job applicants. A Colorado property address alone does not establish the visitor's residence or context. [C.R.S. § 6-1-1303(6), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Ask counsel to classify relocation and investor inquiries from the facts. ## Keep the exceptions beside the threshold decision The 2026 statute separately reaches controllers processing any amount of biometric identifiers or biometric data. Below the general thresholds, that coverage concerns the biometric information collected and processed. The biometric amendments took effect 2025.07.01. [C.R.S. §§ 6-1-1304(1)(a)(II), 6-1-1314 and source notes, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Ask whether identity verification, account access, or another integration uses identification biometrics. Do not classify every photograph or video as biometric data. The statutory definitions distinguish ordinary media from identification uses. [C.R.S. § 6-1-1303(2.4)–(2.5), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Specified minor-data provisions apply without the general volume thresholds. They address online services offered to consumers the controller actually knows, or willfully disregards, are minors. A minor is under eighteen. These protections took effect 2025.10.01. [C.R.S. §§ 6-1-1303(16.5), 6-1-1304(1)(b), 6-1-1308.5–1309.5, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Have counsel review any relevant account, chat, or other online feature. This is not an instruction to add age fields to ordinary inquiry forms. The statute does not require an age-verification or age-gating system. [C.R.S. § 6-1-1304(3)(f), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Record any claimed exemption with its exact provision and affected records. Section 6-1-1304 lists entity and data exclusions, including specified financial and health information. Mentioning mortgages on a website does not establish an exemption for every inquiry. Ask counsel to assess the records and activity. [C.R.S. § 6-1-1304(2), (4)–(5), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). ## Map the seller and buyer data paths Personal data includes information linked or reasonably linkable to an identifiable person. Publicly available information and qualifying de-identified data are excluded. [C.R.S. § 6-1-1303(11), (16)–(18), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). For the website brief, separate public property records from private contact details and questions. Use this worksheet for components present on your site: | Path | Evidence to collect | Question for counsel and the provider | | --- | --- | --- | | Seller valuation or contact form | Fields, receiving account, stored copies, and later uses | Which data serves the requested conversation? | | Buyer inquiry or saved search | Parent site, search domain, account records, and delivery destination | Who controls each record and handles requests? | | Analytics or advertising integration | Configuration, identifiers, destinations, purposes, and contract | Which activity is targeted advertising or sale? | | Chat, scheduler, or verification feature | Transcripts, permissions, location collection, and identification functions | Does it involve sensitive data, biometrics, or known minors? | Colorado sale includes exchanges for money or other valuable consideration, with specified exclusions. Targeted advertising concerns information from activity across nonaffiliated sites or services; its definition also contains exclusions. Do not classify every analytics request or vendor transfer alike. [C.R.S. § 6-1-1303(23), (25), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Sensitive data includes specified health, citizenship, biometric, and child information, plus precise device geolocation. The geolocation addition took effect 2025.05.23. [C.R.S. § 6-1-1303(24) and source notes, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Review a location-enabled feature separately from a public property map. Do not request private health or identity documents through an ordinary home-search form. ## Check the website even when the general thresholds do not apply Keep a dated record of the reviewed entity, count method, exceptions, and unresolved items. Assign another review after a relevant vendor, ownership, market, or data-use change. As website requirements, limit ordinary inquiries to the question and reply details needed. Check where records go, who can access them, and which public statements describe those uses. Assign an owner for privacy questions. Test buyer and seller delivery using details you control. These recommendations do not impose every CPA duty on a below-threshold business. Other Colorado protections need their own scope check. Sections 6-1-713 and 6-1-713.5 address disposal policies and reasonable security for defined personal identifying information. They do not use the CPA's general consumer-volume thresholds. Their information definition includes passwords, government identification numbers, and financial transaction devices. [2026 C.R.S. §§ 6-1-713–713.5, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). If accounts or uploads involve those records, obtain counsel's requirements for storage, access, vendor security, and disposal. Keep transaction retention and legal holds in the brokerage's approved process. ## Translate confirmed CPA coverage into working controls For a covered controller, the privacy notice must explain data categories, purposes, rights methods, contact information, appeals, and third-party sharing categories. Sale or targeted advertising requires clear disclosure and an opt-out explanation. Collection must be limited to the specified purpose. Incompatible secondary uses and sensitive-data processing require the applicable consent. [C.R.S. § 6-1-1308, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Have counsel approve the notice and required choices. Give the builder the actual form fields, vendor destinations, approved text, and expected behavior. Check the notice from the inquiry page on phone and desktop. Consumers have access, correction, deletion, portability, and specified opt-out rights. Opt-outs cover targeted advertising, sale, and profiling for decisions affecting matters such as access to housing. Request methods must fit normal interactions; a new account cannot be required. The controller must establish an appeal route. [C.R.S. §§ 6-1-1303(10), 6-1-1306(1), (3), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). The ordinary request response period is **45 days**, with a justified **45-day extension** and timely notice. Appeals have a **45-day response period** and a possible **60-day extension**. Keep those clocks separate. [C.R.S. § 6-1-1306(2)–(3), checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Assign the receiving person, verification procedure, record search, and counsel-approved handling of exceptions. Since 2024.07.01, covered businesses must allow GPC opt-outs for sale or targeted advertising. The Attorney General also requires a privacy-policy explanation of universal opt-out handling. [Colorado AG universal opt-out guidance, checked 2026.10.14](https://coag.gov/opt-out/). Request evidence from each affected vendor, including embedded listing search. Keep detailed GPC diagnostics in a separate test brief. Require the privacy choice and ordinary property inquiry to work together. ## Assign assessments and vendor responsibilities Covered controllers must document assessments for specified higher-risk processing, including sale, sensitive data, and targeted advertising. The statute also addresses qualifying profiling risks. [C.R.S. § 6-1-1309, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Have counsel identify the assessment requirement before adding the affected feature. A website scan does not replace that assessment. Processors must follow instructions and assist with consumer requests. Their contracts must set out processing instructions, purposes, data types, duration, and allocated responsibilities. Roles depend on the processing facts. [C.R.S. § 6-1-1305, checked 2026.10.14](https://olls.info/crs/crs2026-title-06.htm). Name who changes the website, who instructs each vendor, and who handles records beyond the builder's access. Leave unconfirmed vendor support unresolved. ## Accept the website against recorded results Your Colorado worksheet leaves legal applicability with counsel and records separate website tests. Bring counsel-approved implementation requirements to [whole website fix: Colorado privacy changes](/for/real-estate). For the whole website fix, findings carry supporting audit evidence. [Published work offer, checked 2026.10.14](https://scalewithsearch.com/work). - [Test the seller inquiry path on your real estate website](/articles/seller-inquiry-path-agent-website) - [Check your real estate website in 30 minutes](/articles/real-estate-website-audit) - [Own your real estate website: domain, hosting, editing, and leads](/articles/own-your-site) ## Related: Real estate - [Test the seller inquiry path on your real estate website](/articles/seller-inquiry-path-agent-website) - [Check your real estate website in 30 minutes](/articles/real-estate-website-audit) - [Own your real estate website: domain, hosting, editing, and leads](/articles/own-your-site) ---- ```text .|########||. .|########||. .|########||. |##||. .||##|. |##||. .||##|. |##||. .||##|. |#|. .|#|. |#|. .|#|. |#|. .|#|. |#| |#| |#| |#| |#| |#| .#| |#. .#| |#. .#| |#. .#. .#| .#. .#| .#. .#| |#. .#| |#. .#| |#. .#| |# ...... #| |# ...... #| |# ...... #| .# ||#########| #| .# ||#########| #| .# ||#########| #| .#. |######||######|. .#. .#. |######||######|. .#. .#. |######||######|. .#. #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# #. .##|###|##|#|######| .# || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || || |##|#||||||||||||#||#| || # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. # |#||||||||||||||||||||#| #. || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # # .#||||||||||||||||||||||||#| # || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || || ....|||#||||||##|#|||#|#||##||||....|. || #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# #. . ....|# ....#||| ||| .#||| ....#. .# # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. # . ||||#| .#####|| . .#| .#||| ||||# #. .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || .| ||||| #. |#|||||. || #. |#||. .||||| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || || |.... #. ....|#. |. ...|. ....|| || #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# #. .||||||##||||||##||####|||||||#||||||#| .# # .||####|###########################|. # # .||####|###########################|. # # .||####|###########################|. # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#||||||.#.|| # |. ..# #| #|||||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||||| .. |# ## |#| ...#|#|||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#|||#|# .# .#| #| ##|.#..#|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # .#||||||############|######|||||#| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # # |...||#||||||#||||#|#||||||#|||||#||| |.| # #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# #. .. ||||# .|||##|. |#| .|| || .|||#. #| # .# || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || | ...|| ...##| | #| .|. |. ##### .. .| || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || || ||||| || ||||#| . |. |. |#. ||||| |#| || || .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. .# |.....#|....|#.||||.|||##.|#|....||.#||.#. #. #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# #.|||||||#############################| ||| .# || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || || ##||#||#||||||#||#||#||#||##. || # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # # .#|||||||||#||#|||||||||||#| # || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || || |#||||||||||||||||||||||#| || .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. .# |#||||||||||||||||||||#| #. || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || || |#||||||||||||||||||#| || #. .######|#|#########| .# #. .######|#|#########| .# #. .######|#|#########| .# .#. |#####||||#####| .#. .#. |#####||||#####| .#. .#. |#####||||#####| .#. |# ||########|| #. |# ||########|| #. |# ||########|| #. |# ...... #| |# ...... #| |# ...... #| |#. .#| |#. .#| |#. .#| |#. .#. |#. .#. |#. .#. .#| |#. .#| |#. .#| |#. |#| |#| |#| |#| |#| |#| .|#|. .|#|. .|#|. .|#|. .|#|. .|#|. |##||. .||##| |##||. .||##| |##||. .||##| .||########||. .||########||. .||########||. Scale With Search 2026 [scalewithsearch.com](https://scalewithsearch.com) ```