Material Applicability

The CPA's material scope is defined through several key factors:

• Personal and domestic use exemption
• Sectoral exceptions regulated by other laws
• Central bank and financial institutions exclusion
• Revenue and data subject thresholds

Personal and Domestic Use Exemption

CPA Sec.6-1-1304(3)(e):

"THE OBLIGATIONS IMPOSED ON CONTROLLERS OR PROCESSORS UNDER THIS PART 13 DO NOT: (e) APPLY TO THE PROCESSING OF PERSONAL DATA BY AN INDIVIDUAL IN THE COURSE OF A PURELY PERSONAL OR HOUSEHOLD ACTIVITY."

The exemption applies strictly to individuals processing data for personal purposes, with the burden of proof falling on the controller to demonstrate qualification for the exemption.

Sectoral Exceptions

CPA Sec.6-1-1304(2)(q):

"THIS PART 13 DOES NOT APPLY TO: (q) A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION AS DEFINED BY AND THAT IS SUBJECT TO THE FEDERAL "GRAMM-LEACH-BLILEY ACT""

CPA Sec.6-1-1304(2)(j)(III-V):

"THIS PART 13 DOES NOT APPLY TO: (j) PERSONAL DATA: (III) COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO THE FEDERAL "DRIVER'S PRIVACY PROTECTION ACT OF 1994""

"(IV) REGULATED BY THE FEDERAL "CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998""

"(V) REGULATED BY THE FEDERAL "FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974""

These provisions exempt data processing activities already regulated by specific federal laws to prevent duplicative regulation.

Quantitative Thresholds

The CPA applies to controllers meeting specific thresholds related to:

• Processing personal data of 100,000 or more Colorado consumers per year
• Revenue derived from the sale of personal data

Territorial Applicability

The CPA's territorial scope is primarily determined by:

• Business conduct in Colorado
• Intentional targeting of Colorado residents

CPA Sec. 6-1-1304(1)(a):

"EXCEPT AS SPECIFIED IN SUBSECTION (2) OF THIS SECTION, THIS PART 13 APPLIES TO A CONTROLLER THAT: (a) CONDUCTS BUSINESS IN COLORADO OR PRODUCES OR DELIVERS COMMERCIAL PRODUCTS OR SERVICES THAT ARE INTENTIONALLY TARGETED TO RESIDENTS OF COLORADO"

The law applies to entities that either:

• Conduct business in Colorado

• Intentionally target Colorado residents with products or services