Distributes a software product, in Colorado

C.R.S. 6-1-713 (amended by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 1) · Read the law's page

• This binds any person who maintains, owns, or licenses personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-disposal requirements it follows is deemed to comply.
• Develop a written policy for the destruction or proper disposal of paper and electronic documents containing personal identifying information, and, once those documents are no longer needed, destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable.
• Enforcement runs alongside the reasonable-security-procedures duty at section 6-1-713.5: the Colorado Attorney General may bring an action under section 6-1-716(4) to compel compliance or recover direct economic damages, and a violation is also a deceptive trade practice under section 6-1-105(1)(x), reaching the Consumer Protection Act's civil penalty of up to $20,000 per violation and a private right of action under section 6-1-113.

C.R.S. 6-1-713.5 (added by HB 18-1128, 2018 Colo. Sess. Laws ch. 266, section 2) · Read the law's page

• This binds any person who maintains, owns, or licenses the personal identifying information of a Colorado resident in the course of the person's business, vocation, or occupation; a covered entity already regulated by a state or federal regulator whose data-security requirements it follows is deemed to comply.
• Implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information (a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device) from unauthorized access, use, modification, disclosure, or destruction.
• Where personal identifying information is disclosed to a third-party service provider, require that provider to implement and maintain its own reasonable security procedures and practices, unless the covered entity retains primary responsibility and implements technical controls that protect the information from unauthorized access or effectively eliminate the third party's ability to access it.
• A violation is enforceable by the Colorado Attorney General under section 6-1-716(4) to compel compliance or recover direct economic damages, and, as a violation of part 7 of the Colorado Consumer Protection Act, is also a deceptive trade practice under section 6-1-105(1)(x), reaching the act's civil penalty of up to $20,000 per violation under section 6-1-112(1)(a) and a private right of action under section 6-1-113 for actual damages, a $500 statutory minimum, treble damages for bad-faith conduct, and attorney fees.

C.R.S. section 24-85-104 (as amended by HB 21-1110) · Read the law's page

• If you supply applications, programs or operating systems that a Colorado state agency uses to manipulate and present information, make them, including the format of the data, permit the installation and effective use of, and be compatible with, software and peripheral devices that provide accessibility to an individual with a disability (C.R.S. 24-85-104(3)).
• Meet that compatibility requirement at the time the state agency procures an upgrade or replacement of existing information technology equipment or software (C.R.S. 24-85-104(4)).

C.R.S. section 24-85-104(5), as added by HB 25-1152 · Read the law's page

• If you contract with a Colorado state agency or other public entity to supply goods, services or construction, comply with the accessibility standards for an individual with a disability that the Office of Information Technology adopted under section 24-85-103 (8 CCR 1501-11); the contract is deemed to require it even if the clause is omitted (C.R.S. 24-85-104(5)(b) and (c)(I)).
• Indemnify, hold harmless and assume liability for the state agency or public entity and its officers, employees and agents for all costs, claims, damages, court awards and attorney fees it incurs in relation to your noncompliance with those standards (C.R.S. 24-85-104(5)(c)(II)).
• If the state agency or public entity requires it, have your compliance with those standards determined and attested to by a qualified third party it selects (C.R.S. 24-85-104(5)(d)).
• These terms reach contracts entered into, amended or renewed on or after August 6, 2025, other than public school contracts under section 22-1-135 and contracts for professional services.