AI Governance Engineer
GitHub

Colorado Privacy Act: profiling opt-out and data protection assessments

Consumers may opt out of profiling in furtherance of decisions with legal or similarly significant effects, incl. through a universal opt-out mechanism; controllers run data protection assessments for processing that presents a heightened risk

By Reviewed

From clause to evidenceThe chain from Colorado Privacy Act SB21-190 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: Colorado Privacy Act (SB21-190), SB21-190ClauseColoradoPrivacy ActSB21-190Duty holder: ControllersDuty holderControllersApplies from: 2023-07-01 (In force)Applies from2023-07-01In forceArtefact: Opt-out flag honoured at inference; assessment template; intake data-class flagsArtefactOpt-out flaghonoured at…Layers: Layer 01 Govern-as-Code and Layer 02 Inventory & Transparency and Layer 04 Runtime Controls & Observability and Layer 05 Assurance & Continuous ComplianceLayersLayer 01Layer 02Layer 04Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence recordv1Same topic elsewhere: no crosswalk topic files this clause yetAs of 2026-09-24 · illustrative, not a claim of conformity From clause to evidenceThe chain from Colorado Privacy Act SB21-190 to its evidence record, in 6 steps; the text alternative lists them and the facts under the figure state each in full.Clause: Colorado Privacy Act (SB21-190), SB21-190ClauseColorado Privacy Act · SB21-190Duty holder: ControllersDuty holderControllersApplies from: 2023-07-01 (In force)Applies from2023-07-01 · In forceArtefact: Opt-out flag honoured at inference; assessment template; intake data-class flagsArtefactOpt-out flag honoured at…Layers: Layer 01 Govern-as-Code and Layer 02 Inventory & Transparency and Layer 04 Runtime Controls & Observability and Layer 05 Assurance & Continuous ComplianceLayersLayer 01Layer 02Layer 04Layer 05Evidence record: the common evidence record (Evidence record v1)Evidence recordEvidence record v1Same topic elsewhere: no crosswalk topicfiles this clause yetAs of 2026-09-24illustrative, not a claim of conformity
From clause to evidence Build the artefact, then file every output it produces as a record that names AIGE-OBL-USCO-CPA. Drawn from chapter 08.
Text alternative
  • Clause: Colorado Privacy Act, SB21-190.
  • Duty holder: Controllers.
  • Applies from: 2023-07-01, In force.
  • Artefact: Opt-out flag honoured at….
  • Layers: Layer 01, Layer 02, Layer 04, Layer 05.
  • Evidence record: Evidence record v1.
  • Record schema: Evidence record.
  • No crosswalk topic files this clause yet.
When this obligation appliesThe date of AIGE-OBL-USCO-CPA on a time axis, against its review date 2026-09-24.Earlier2024202620282030As of 2026-09-242023-07-01 · In force2023-07-01 · In forceSource: Obligation register(chapter 08)
When this obligation appliesThe date of AIGE-OBL-USCO-CPA on a time axis, against its review date 2026-09-24.2023-07-01 · In force2024202620282030EarlierAs of 2026-09-242023-07-01 · In forceSource: Obligation register (chapter 08)
When this obligation applies The first date in the row's status, then each later step: filled once its date has passed, outlined while it is still ahead of the review date.
Data table: the dates
Dates of AIGE-OBL-USCO-CPA
DateStepDetail
2023-07-01In force
Id
AIGE-OBL-USCO-CPA
Instrument
Colorado Privacy Act (SB21-190) law
Clause
SB21-190
In scope
Controllers
Authority
Attorney General and district attorneys
Applies from
In force

The artefact that evidences it

Opt-out flag honoured at inference; assessment template; intake data-class flags.

Patterns that build it

No pattern in the catalogue names this clause on its "Maps to" line yet; the artefact above is the engineering answer.

Source

Chapter 08, section State privacy and sector laws, checked against its sources on the review date above.

Machine-readable

Cite this obligation

García Aibar, J. (2026). Colorado Privacy Act: profiling opt-out and data protection assessments (AIGE-OBL-USCO-CPA). In AI Governance Engineering: The Thesis & Body of Knowledge (v0.5.0). https://doi.org/10.5281/zenodo.22956197. https://aigovernanceengineer.com/obligations/aige-obl-usco-cpa. CC BY 4.0

BibTeX

@misc{aige2026obligation,
  author       = {Jorge García Aibar},
  title        = {{Colorado Privacy Act: profiling opt-out and data protection assessments (AIGE-OBL-USCO-CPA)}},
  howpublished = {In AI Governance Engineering: The Thesis \& Body of Knowledge},
  year         = {2026},
  version      = {0.5.0},
  doi          = {10.5281/zenodo.22956197},
  url          = {https://aigovernanceengineer.com/obligations/aige-obl-usco-cpa},
  note         = {Version 0.5.0}
}