University of Colorado Boulder Privacy Statement

The University of Colorado Boulder (CU Boulder) respects the information privacy of campus community members and visitors. It recognizes the numerous laws that govern the collection, storage, transfer, use and access of personally identifiable information (PII). This statement is applicable to the processing of all PII, regardless of source or medium. 

When required to meet legal and compliance obligations, CU Boulder may request access to or disclose specific PII through established processes. In all cases, CU Boulder complies with the Family Educational Rights and Privacy Act (FERPA), the Colorado Open Records Act (CORA), APS 2022: CORA, the Health Insurance Portability and Accountability Act (HIPAA), and other applicable laws and policies. In situations where PII is required to be disclosed, CU Boulder endeavors to apply all applicable exceptions and exclusions to continue protecting the privacy of PII whenever possible. 

In addition to this campus-wide statement, CU Boulder’s schools, colleges, centers, institutes, departments, and other units may have additional privacy notices reflecting their specific practices related to the processing of PII. Some CU Boulder websites may also include links to external sites, which may have separate privacy policies. CU Boulder is not responsible for the privacy practices of external entities or websites. 

For the purposes of this statement, information includes data. 

Privacy Principles 

CU Boulder is committed to the following privacy principles related to personally identifiable information: 

  • Collect only the minimum information required  

  • Comply with applicable laws 

  • Secure information by ensuring controls are risk-based and appropriate 

  • Communicate what and how information is used, when practicable 

  • Use and share information, consistent with the purpose of information collection and legal and compliance obligations 

  • Limit access only to those who need the information to perform the duties of their role 

  • Retain information according to APS 2006: Retention of University Records 

Collection of PII varies depending on the nature of the services offered, the type of information, and legal and compliance requirements. CU Boulder collects information directly from the individual, through automated processes (for example, via software or websites that an individual may engage with), and from third-party service providers. CU Boulder collects and processes information for groups including, but not limited to, prospective students, current students, program participants, staff, faculty, persons of interest (POIs) and CU Boulder affiliates, visiting scholars and exchange students, alumni, donors and prospective donors, research subjects, participants in conferences and campus events, website users and visitors to campus.  

CU Boulder uses public information and PII that is collected to facilitate operational, educational, and outreach activities. CU Boulder uses PII for the purposes for which it was collected, unless it is needed for another related reason that is compatible with the original purpose, or as permitted by applicable law. Some examples of how CU Boulder may use PII include, but are not limited to: 

  • To facilitate recruitment and admission and provide services for students and prospective students; 

  • To provide and administer housing to students; 

  • To manage the employment of faculty, staff, and student employees; 

  • To provide academic advising and other academic and student support services; 

  • To deliver and assess course materials and education programs; 

  • To analyze and improve education programs; 

  • To conduct research;  

  • To manage the employment of faculty, staff, and student employees; 

  • To conduct analyses to improve university programs; 

  • To track use of university assets, such as library materials or reservable spaces; 

  • To provide tailored digital experiences; 

  • To conduct outreach, including alumni and donor engagement; 

  • To manage and oversee relationships with suppliers and business partners; 

  • To comply with applicable laws and compliance and contractual obligations; 

  • To comply with accreditation requirements and other related processes and operations; 

  • To track use of university assets, such as library materials or reservable spaces; and, 

  • To manage and oversee relationships with suppliers and business partners. 

CU Boulder may share PII with third-party service providers to support its operations. Through CU’s contracting processes, CU Boulder requires third-party service providers to take appropriate security measures to protect PII pursuant to University of Colorado policy and applicable law, linked in the Related Policies and Resources section below. CU Boulder takes reasonable and appropriate measures to protect PII from unauthorized access or disclosure. CU Boulder may also share PII with third-party service providers in certain circumstances including, but not limited to, when the individual has consented, or when necessary to comply with any legal or compliance obligations; to administer a contract with the university; to fulfill federal- or state-audits; to facilitate business processes or reporting; or to assist university-affiliated programs in contacting an individual. For additional information about FERPA exceptions, visit the Exceptions to Student Consent website. 

CU Boulder may provide chat rooms, forums, message boards, or similar groups, spaces or tools. Any participation in or information disclosed in these areas may become public information, and users should therefore exercise caution when deciding to disclose PII. Chat sessions and discussion forums may be logged. 

CU Boulder is committed to maintaining the security of the information it processes and strives to ensure reasonable security measures are in place, including physical, administrative, and technical safeguards to protect PII. However, no service is completely secure. If an individual believes their PII, including a colorado.edu account or CU login name and password, may be at risk, they should immediately report it to security@colorado.edu.

CU Boulder websites may use web services (cookies) to analyze website performance and deliver tailored advertisements on third-party websites to previous CU Boulder site users.  CU Boulder is not collecting any PII through the use of these cookies or any other third-party remarketing system on its core website and content management platforms. 

In addition to using cookies as described above, CU Boulder may also permit third-party service providers to help tailor advertising to users by collecting and using other information about user activities on CU Boulder sites and services. These companies may deliver ads that might also place cookies and otherwise track user behavior. The information collected on user activities is not PII but is used to help determine if a user took action from the advertisement. 

An individual can utilize browser extensions or opt out of third-party service providers’ use of cookies by visiting https://optout.aboutads.info/ and https://thenai.org/how-to-opt-out/. 

The Children’s Online Privacy Protection Act (COPPA) imposes requirements on certain operators of commercial websites or online services. CU Boulder is committed to protecting the privacy of children under the age of 13 and thus does not intend to solicit PII from children under the age of 13 without consent by their parent or guardian.  

Users under the age of 13 and their parents or guardians are cautioned that the collection of PII volunteered online or by e-mail by children under the age of 13 without parental consent will be treated the same as information provided by an adult until CU Boulder becomes aware that the user is under the age of 13. 

CU Boulder complies with the Family Educational Rights and Privacy Act (FERPA) regarding the use and disclosure of student educational information. A guide to understanding FERPA can be found on the Office of the Registrar website and the Exceptions to Student Consent website. 

Health information provided to or created by CU Boulder mental and physical health services may have additional confidentiality, privacy, and security protections under the Family Educational Rights and Privacy Act (FERPA), the Health Insurance Portability and Accountability Act (HIPAA), the Health Information Technology for Economic and Clinical Health Act (HITECH), and applicable law. CU Boulder mental and physical health services include, but are not limited to, Faculty and Staff Assistance Program (FSAP), Counselling and Psychiatric Services (CAPS), Office of Victim Assistance (OVA), Disability Services and Medical Services. More information about health information and privacy and security practices can be found on each of the health services websites. 

In addition to the general privacy information provided above, the EU GDPR supplemental information outlines the collection, use, and disclosure of PII provided to CU Boulder. 

CU Boulder is committed to the retention of its records to meet legal requirements, optimize use of space, minimize cost, preserve the history of the university and destroy outdated and useless records. Please see APS 2006 - Retention of University Records and Records Retention & Disposition for more information. 

Personally identifiable information (PII): Any recorded information and data relating to an individual that can be used to identify that individual. This does not include information in which identifying details have been removed. 

Personally identifiable information processing: Anything done with personally identifiable information including, but not limited to, collection, storage, transfer, use and access. 

Public information: Any information on CU Boulder websites to which the data owner allows access without authentication, information made freely available through CU Boulder print material, and directory information. 

For privacy-related inquiries, please contact compliance@colorado.edu.