Ships a mobile app, in Colorado

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343) · Read the law's page

• Applies to operating system providers, covered application stores and application developers; broadband internet access service, telecommunications service and open source operating systems are excluded.
• As an operating system provider or covered application store, let an account holder indicate a birth date, age or age bracket at device setup, and share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers.
• As an application developer, treat the signal as the primary indicator of a user's age range unless you have clear and convincing information otherwise.