Colorado Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 12, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 12, 2026.

Current Landscape

The supplied Colorado data lists one lawsuit, zero demand letters, and a separate tracked-matter count of zero. The relationship between these counts is unclear, so they should not be combined into a single total. The dataset labels Colorado’s risk level as Moderate, but provides no methodology for that rating.

The supplied case summary identifies McCulley, et al. v. Banner Health. According to the court-authorized settlement website, plaintiffs alleged that Banner Health disclosed patient-account users’ personal and health information to third parties, including Meta and Google, through website tracking technologies. Banner denies liability. These are allegations, not verified judicial findings.

The website’s documents page lists a Final Approval Order, but its contents could not be retrieved. Its specific rulings, decision date, and any appeal status remain unverified. The supplied facts establish no standing determination or substantive holding. Although the dataset lists the Colorado Wiretapping Statute and numerous technologies, it does not establish that the statute or every listed technology was involved in this case.

Current Litigation Activity

Current litigation component: 17/100.

Important New Filings

• McCulley, et al. v. Banner Health

Current Filing & Litigation Trends

One listed lawsuit and zero listed demand letters are insufficient to establish a filing trend, an increase in activity, or continuing judicial attention. The separate tracked-matter count of zero also requires clarification before drawing conclusions about the scope of monitoring.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• Colorado Wiretapping Statute — Colo. Rev. Stat. § 18-9-303

Regulatory Enforcement

Regulatory enforcement component: 54/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

• CPA enforcement launch — Colorado Attorney General
  Attorney General Weiser announced the launch of CPA enforcement on July 12, 2023.
• Reported looming investigations by Colorado regulators
  The article reports that Colorado regulators are considering investigations related to companies' handling of opt-outs and privacy rights.

Agency Guidance

[object Object],[object Object],[object Object],[object Object]

Regulatory trend: active.

Global Privacy Control / Opt-Out Signals

Currently required

GPC / universal opt-out exposure component: 90/100. This component reflects whether the state currently requires or recognizes universal opt-out preference signals (such as GPC) and related enforcement activity, and is a weighted input to the overall risk guideline. It describes the state's legal posture — never any individual website's behavior.

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

Effective since: July 1, 2024.

GPC is currently the only mechanism considered valid by the Department. The recognized-mechanism list may be updated following applications and public comment.

GPC evidence confidence: 99%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Website tracking technologies
• Banner Health Patient Account, formerly the MyBanner patient portal
• Global Privacy Control
• in-browser opt-out preference signals
• Browser opt-out settings and extensions
• Opt-out preference signals
• Browser settings
• Browser extensions
• Sec-GPC request header
• navigator.globalPrivacyControl DOM property
• Browser privacy settings
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications
• Beauty filters
• Visible like counts
• Meta Pixel
• HTTP header
• DOM
• JavaScript
• JavaScript property
• Social media pixel
• Software development kit (SDK)

Historical Risk Guideline

What Businesses Should Review

Organizations can review which tracking tools operate on account or portal pages, what information third-party requests transmit, when those requests occur, and whether privacy disclosures match observed data flows. If browser opt-out signals or consent controls are relevant to their deployments, organizations can examine how those controls affect tracking behavior; the supplied facts do not establish that these controls were at issue in McCulley. For further case reporting, retrieve and review the Final Approval Order and verify the decision date, specific rulings, and appeal status before describing any judicial outcome.

Data Quality

39 source(s), 13 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Colorado Privacy Act (CPA) — Colorado Attorney General · Tier A (Primary authority)
• Press & Announcements | Global Privacy Control — Global Privacy Control · Tier E (General web)
• California Privacy Protection Agency Announces Joint Investigative Privacy Sweep: CA, CO, and CT Investigate Businesses Refusing to Honor Consumers’ Right to Opt-Out of the Sale of Their Personal Information — California Privacy Protection Agency · Tier A (Primary authority)
• California Privacy Protection Agency Announces Joint Investigative Privacy Sweep: CA, CO, and CT Investigate Businesses Refusing to Honor Consumers’ Right to Opt-Out of the Sale of Their Personal Information — California Privacy Protection Agency · Tier A (Primary authority)
• Global Privacy Control Application — Colorado Office of the Attorney General · Tier A (Primary authority)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Docket Print Results — Weld County, Case No. 2026CV30182 — Colorado Judicial Branch · Tier A (Primary authority)
• Colo. Hospital Seeks To Toss Meta Pixel Patient Data Suit — Law360 Healthcare Authority · Tier B (Authoritative secondary)
• McCulley, et al. v. Banner Health — Important Documents, Including Final Approval Order — Kroll Settlement Administration LLC — Court-authorized settlement website · Tier B (Authoritative secondary)
• Global Privacy Control (GPC) — W3C · Tier E (General web)
• Global Privacy Control (GPC): W3C Working Draft — World Wide Web Consortium · Tier E (General web)
• Docket Print Results — McCulley, Cheryl, Case No. 2026CV30182, Weld County — Colorado Judicial Branch · Tier A (Primary authority)
• McCulley, et al. v. Banner Health — Banner Health Data Settlement · Tier B (Authoritative secondary)
• Colo. Hospital Seeks To Toss Meta Pixel Patient Data Suit — Law360 Healthcare Authority · Tier B (Authoritative secondary)
• Global Privacy Control (GPC) — W3C Working Draft — World Wide Web Consortium · Tier E (General web)
• Website Tracking Lawsuit Against Retailer Dismissed for Lack of Standing: What California Ruling Means for Your Business — Fisher Phillips LLP · Tier B (Authoritative secondary)
• Browser Opt-Out Tool Shoots for Simplicity, Brings Uncertainty — Bloomberg Law · Tier B (Authoritative secondary)
• FullStory and CIPA: Is Your Session Recording Tool Creating Legal Liability? — ConsentPixel · Tier D (Industry data)
• Universal Opt-Out Mechanisms: State Requirements and Penalties — LegalClarity · Tier C (Professional analysis)
• Global Privacy Control for Financial Services: A State-by-State Scope Test — RiskTemplates · Tier D (Industry data)
• California Website Tracking, Privacy & Wiretap Litigation — Crandall Consulting · Tier D (Industry data)
• Universal Opt-Out Mechanisms: Which States Require Them — CookieBeam · Tier D (Industry data)
• Universal Opt-Out Mechanism (UOOM) Compliance: What Every Business Needs to Know in 2026 — PrivacyLawMap · Tier D (Industry data)
• California governor signs new law requiring in-browser opt-out preference signal — IAPP · Tier D (Industry data)
• Multistate Privacy Enforcement Sweep Puts Global Privacy Control in the Spotlight — Goodwin (published on JD Supra) · Tier C (Professional analysis)

All State Pages