Deploys a chatbot, in Colorado

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

C.R.S. 6-1-1708 · Read the law's page

• Starting August 12, 2026, use commercially reasonable or generally accepted methods to estimate the age of your account holders and other users, and do not willfully disregard clear and convincing information that one of them is a minor
• Starting January 1, 2027, if you know an account holder or user is a minor, clearly and conspicuously disclose that they are interacting with artificial intelligence, in response to their prompts asking whether the service is artificially generated and not human, and through a persistent visible disclaimer on a product with a screen interface, an intermittent audio disclaimer on a product without one, or a disclosure at the beginning of each interaction that recurs at least once every three hours of a continuous interaction
• Starting January 1, 2027, if you know an account holder or user is a minor, do not give them points or similar rewards at unpredictable intervals meant to increase engagement
• Starting January 1, 2027, if you know an account holder or user is a minor, institute technically feasible measures preventing the service from producing explicit sexual content or intimate digital depictions involving a minor, or from engaging in or encouraging explicit sexual conduct with a minor, and reasonable measures preventing it from claiming to be human or sentient, simulating a romantic companionship, or role-playing an adult-minor romantic relationship
• Starting January 1, 2027, if you know an account holder or user is a minor, offer them and their parent or guardian tools to manage privacy and account settings, including whether the service retains prior interactions for personalization or uses their data to train the service
• Starting January 1, 2027, disclose to every user, not only minors, that the service is artificial intelligence (at the beginning of the user's first interaction each day, at least once every three hours of a continuous interaction or through a persistent visible disclosure, and in response to user prompts asking whether the service is artificially generated and not human), implement a protocol for responding to a user prompt about suicidal ideation or self-harm that refers the user to a crisis service provider rather than law enforcement, and do not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian
• Starting July 1, 2027, report annually to the Attorney General on the number of crisis-service-provider referrals issued and the protocols used to detect, prevent, and respond to suicidal ideation or self-harm, without including any user-identifying information

Colo. HB 26-1195, 2026 Colo. Sess. Laws ch. 358 · Read the law's page

• Do not allow an AI system to interact with a client in any form of therapeutic communication unless the regulated professional, the AI system and the client interact synchronously in real time, and do not let it generate therapeutic recommendations or treatment plans without the professional's review and approval
• Do not use an AI system to provide, direct or guide psychotherapy, clinical intervention, counseling, diagnosis or treatment planning except for educational, administrative, simulation, training or research purposes or as the act allows
• At initial client contact, inform clients of the prohibitions on the use of AI systems in the practice of psychotherapy
• If a client's therapeutic session will be recorded or transcribed through an AI system, disclose the use and its purposes in advance and obtain the client's written, informed consent
• Do not use a term, letter or phrase in your AI system that implies its outputs are provided by, endorsed by or equivalent to services of a regulated professional, that represents that the system provides psychotherapy services, or that represents that user data is confidential in a way that suggests therapist-client confidentiality