Is odometer fraud a felony or a misdemeanor?
It's both: a felony under federal law, and a misdemeanor under Colorado law. There's no conflict; each of those sovereigns can enforce its laws independently. Someone who tampers with an odometer could be prosecuted in federal court, and convicted of a felony; or prosecuted in Colorado court, and convicted of a misdemeanor; or even both.
In practice, it sounds like the federal authorities are most interested in prosecuting large-scale odometer fraud schemes, and would generally leave one-off cases to the state authorities.
Are there exceptions where this may not be enforceable? This site (https://www.nhtsa.gov/equipment/odometer-fraud) indicates that the requirement for a written disclosure of odometer roll-back is not applicable for vehicles over 20 years old (also pre-2010 models, which seems a bit more restrictive). I'm having a hard time nailing this particular restriction down in the Colorado Statutes. Can anyone point out where this law is defined?
As far as I can tell, Colorado law simply incorporates the federal requirement:
CRS 42-6-202 (5): It is unlawful for any transferor to fail to comply with 49 U.S.C. sec. 32705 and any
rule concerning odometer disclosure requirements or to knowingly give a false statement to a
transferee in making any disclosure required by such law.
49 USC 32705 (a)(5) permits the Secretary of Transportation (i.e. the federal Department of Transportation) to make regulations that carve out exemptions from the mileage disclosure rules, which can be found at 49 CFR 580.17 and include the 20-year and 2010 rules. So these same exemptions apply to the state requirement. (Incidentally, the Colorado title forms do not mention this exemption.)
Note, however, that this is only an exemption from the disclosure requirement. There is no exemption from the general law against odometer fraud. It is illegal to tamper with an odometer no matter how old the car is.
What is the statute of limitations to pursue crimes of odometer fraud? I think this is answered in Colorado Statute 13-80-102(j) (https://leg.colorado.gov/sites/default/files/images/olls/crs2020-title-13.pdf). This seems to indicate this type of fraud has a 2-year timeline. Does this apply from date of purchase or date of discovery?
13-80-102 is a statute of limitations for civil actions, and it does indeed cover actions for odometer fraud (see (1)(j) which references CRS 42-6-204). This would apply if the buyer wanted to sue the seller in civil court. But that's unrelated to the criminal statues we discussed above, which would be prosecuted in criminal court by the state or federal government.
The limit is two years "after the cause of action accrues", which is defined in 13-80-108(3):
A cause of action for fraud, misrepresentation, concealment, or deceit shall be
considered to accrue on the date such fraud, misrepresentation, concealment, or deceit is
discovered or should have been discovered by the exercise of reasonable diligence.
For criminal prosecutions, the Colorado statute of limitations for misdemeanors is generally 18 months, from the time the offense was committed (CRS 16-5-401). For some crimes, it is defined to start instead when the offense was discovered, but odometer fraud doesn't appear to be one of them; still, it could conceivably be prosecuted under other fraud statutes.
As for federal law, the statute of limitations is generally 5 years from commission (18 USC 3282).