°Ç¸ç³Ô¹Ï Privacy Statement

The °Ç¸ç³Ô¹Ï (CU °Ç¸ç³Ô¹Ï) respects the information privacy of campus community members and visitors. It recognizes the numerous laws that govern the collection, storage, transfer, use and access of personally identifiable information (PII). This statement is applicable to the processing of all PII, regardless of source or medium.Ìý

When required to meet legal and compliance obligations, CU °Ç¸ç³Ô¹Ï may request access to or disclose specific PII through established processes. In all cases, CU °Ç¸ç³Ô¹Ï complies with the , the , the , and other applicable laws and policies. In situations where PII is required to be disclosed, CU °Ç¸ç³Ô¹Ï endeavors to apply all applicable exceptions and exclusions to continue protecting the privacy of PII whenever possible.Ìý

In addition to this campus-wide statement, CU °Ç¸ç³Ô¹Ï’s schools, colleges, centers, institutes, departments, and other units may have additional privacy notices reflecting their specific practices related to the processing of PII. Some CU °Ç¸ç³Ô¹Ï websites may also include links to external sites, which may have separate privacy policies. CU °Ç¸ç³Ô¹Ï is not responsible for the privacy practices of external entities or websites.Ìý

For the purposes of this statement, information includes data.Ìý

CU °Ç¸ç³Ô¹Ï is committed to the following privacy principles related to personally identifiable information:Ìý

  • Collect only the minimum information requiredÌýÌý

  • Comply with applicable lawsÌý

  • Secure information by ensuring controls are risk-based and appropriateÌý

  • Communicate what and how information is used, when practicableÌý

  • Use and share information, consistent with the purpose of information collection and legal and compliance obligationsÌý

  • Limit access only to those who need the information to perform the duties of their roleÌý

  • Retain information according to Ìý

Collection of PII varies depending on the nature of the services offered, the type of information, and legal and compliance requirements. CU °Ç¸ç³Ô¹Ï collects information directly from the individual, through automated processes (for example, via software or websites that an individual may engage with), and from third-party service providers. CU °Ç¸ç³Ô¹Ï collects and processes information for groups including, but not limited to, prospective students, current students, program participants, staff, faculty, persons of interest (POIs) and CU °Ç¸ç³Ô¹Ï affiliates, visiting scholars and exchange students, alumni, donors and prospective donors, research subjects, participants in conferences and campus events, website users and visitors to campus.ÌýÌý

CU °Ç¸ç³Ô¹Ï uses public information and PII that is collected to facilitate operational, educational, and outreach activities. CU °Ç¸ç³Ô¹Ï uses PII for the purposes for which it was collected, unless it is needed for another related reason that is compatible with the original purpose, or as permitted by applicable law. Some examples of how CU °Ç¸ç³Ô¹Ï may use PII include, but are not limited to:Ìý

  • To facilitate recruitment and admission and provide services for students and prospective students;Ìý

  • To provide and administer housing to students;Ìý

  • To manage the employment of faculty, staff, and student employees;Ìý

  • To provide academic advising and other academic and student support services;Ìý

  • To deliver and assess course materials and education programs;Ìý

  • To analyze and improve education programs;Ìý

  • To conduct research;ÌýÌý

  • To manage the employment of faculty, staff, and student employees;Ìý

  • To conduct analyses to improve university programs;Ìý

  • To track use of university assets, such as library materials or reservable spaces;Ìý

  • To provide tailored digital experiences;Ìý

  • To conduct outreach, including alumni and donor engagement;Ìý

  • To manage and oversee relationships with suppliers and business partners;Ìý

  • To comply with applicable laws and compliance and contractual obligations;Ìý

  • To comply with accreditation requirements and other related processes and operations;Ìý

  • To track use of university assets, such as library materials or reservable spaces; and,Ìý

  • To manage and oversee relationships with suppliers and business partners.Ìý

CU °Ç¸ç³Ô¹Ï may share PII with third-party service providers to support its operations. Through CU’s contracting processes, CU °Ç¸ç³Ô¹Ï requires third-party service providers to take appropriate security measures to protect PII pursuant to University of Colorado policy and applicable law, linked in the Related Policies and Resources section below. CU °Ç¸ç³Ô¹Ï takes reasonable and appropriate measures to protect PII from unauthorized access or disclosure. CU °Ç¸ç³Ô¹Ï may also share PII with third-party service providers in certain circumstances including, but not limited to, when the individual has consented, or when necessary to comply with any legal or compliance obligations; to administer a contract with the university; to fulfill federal- or state-audits; to facilitate business processes or reporting; or to assist university-affiliated programs in contacting an individual. For additional information about FERPA exceptions, visit the Exceptions to Student Consent website.Ìý

CU °Ç¸ç³Ô¹Ï may provide chat rooms, forums, message boards, or similar groups, spaces or tools. Any participation in or information disclosed in these areas may become public information, and users should therefore exercise caution when deciding to disclose PII. Chat sessions and discussion forums may be logged.Ìý

CU °Ç¸ç³Ô¹Ï is committed to maintaining the security of the information it processes and strives to ensure reasonable security measures are in place, including physical, administrative, and technical safeguards to protect PII. However, no service is completely secure. If an individual believes their PII, including a colorado.edu account or CU login name and password, may be at risk, they should immediately report it to security@colorado.edu.

CU °Ç¸ç³Ô¹Ï websites may use web services (cookies) to analyze website performance and deliver tailored advertisements on third-party websites to previous CU °Ç¸ç³Ô¹Ï site users.  CU °Ç¸ç³Ô¹Ï is not collecting any PII through the use of these cookies or any other third-party remarketing system on its core website and content management platforms.Ìý

In addition to using cookies as described above, CU °Ç¸ç³Ô¹Ï may also permit third-party service providers to help tailor advertising to users by collecting and using other information about user activities on CU °Ç¸ç³Ô¹Ï sites and services. These companies may deliver ads that might also place cookies and otherwise track user behavior. The information collected on user activities is not PII but is used to help determine if a user took action from the advertisement.Ìý

An individual can utilize browser extensions or opt out of third-party service providers’ use of cookies by visiting and Ìý

The Children’s Online Privacy Protection Act (COPPA) imposes requirements on certain operators of commercial websites or online services. CU °Ç¸ç³Ô¹Ï is committed to protecting the privacy of children under the age of 13 and thus does not intend to solicit PII from children under the age of 13 without consent by their parent or guardian.ÌýÌý

Users under the age of 13 and their parents or guardians are cautioned that the collection of PII volunteered online or by e-mail by children under the age of 13 without parental consent will be treated the same as information provided by an adult until CU °Ç¸ç³Ô¹Ï becomes aware that the user is under the age of 13.Ìý

CU °Ç¸ç³Ô¹Ï complies with the Family Educational Rights and Privacy Act (FERPA) regarding the use and disclosure of student educational information. A guide to understanding FERPA can be found on the Office of the Registrar website and the Exceptions to Student Consent website.Ìý

Health information provided to or created by CU °Ç¸ç³Ô¹Ï mental and physical health services may have additional confidentiality, privacy, and security protections under the Family Educational Rights and Privacy Act (), the Health Insurance Portability and Accountability Act (), the Health Information Technology for Economic and Clinical Health Act (), and applicable law. CU °Ç¸ç³Ô¹Ï mental and physical health services include, but are not limited to, Faculty and Staff Assistance Program (FSAP), Counselling and Psychiatric Services (CAPS), Office of Victim Assistance (OVA), Disability Services and Medical Services. More information about health information and privacy and security practices can be found on each of the health services websites.Ìý

In addition to the general privacy information provided above, the outlines the collection, use, and disclosure of PII provided to CU °Ç¸ç³Ô¹Ï.Ìý

CU °Ç¸ç³Ô¹Ï is committed to the retention of its records to meet legal requirements, optimize use of space, minimize cost, preserve the history of the university and destroy outdated and useless records. Please see and Records Retention & Disposition for more information.Ìý

Personally identifiable information (PII): Any recorded information and data relating to an individual that can be used to identify that individual. This does not include information in which identifying details have been removed.Ìý

Personally identifiable information processing: Anything done with personally identifiable information including, but not limited to, collection, storage, transfer, use and access.Ìý

Public information: Any information on CU °Ç¸ç³Ô¹Ï websites to which the data owner allows access without authentication, information made freely available through CU °Ç¸ç³Ô¹Ï print material, and directory information.Ìý

For privacy-related inquiries, please contact compliance@colorado.edu.Ìý


Statement last updated August 24, 2026.Ìý

Ìý