Colorado privacy law INCLUDES nonprofits - https://thenonprofittimes.com/regulation/countdown-to-colorado-privacy-law-npos-not-exempt/
This is as it should be. Nonprofits gather, hold, and rarely protect an enormous amount of very sensitive data of very high value. Think about it - your donations to, volunteer time at, and service from a nonprofit says a LOT about you - much more personal information than your favorite ice cream flavor. Marketers and politicians LOVE this information. And they use it to even further segment and divide us.
Philanthropists need to step up and help nonprofits protect their data and the whole sector needs to massively improve their data governance and protection processes OR stop collecting data OR stop lobbying their way out of accountability.