Serves schools or universities, in Colorado

C.R.S. sections 22-16-101 to 22-16-112 (HB 16-1423, 2016 Colo. Sess. Laws ch. 355) · Read the law's page

• If you are a school service contract provider, give each public education entity you contract with clear, layperson information, in a format easily accessible through a website, on the data elements of student personally identifiable information you collect, the learning purpose for which you collect it, and how you use and share it, and keep it accurate (section 22-16-108(1)).
• Give each public education entity you contract with clear notice before you make material changes to your privacy policy for school services (section 22-16-108(2)).
• Facilitate access to and correction of factually inaccurate student personally identifiable information by a contracting local education provider that has received a correction request from a parent (section 22-16-108(3)).
• On discovering a misuse or unauthorized release of student personally identifiable information held by you, a subcontractor or a subsequent subcontractor, notify the contracting public education entity as soon as possible, whether or not the misuse is a material breach of the contract (section 22-16-108(4)).
• Collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent, and obtain that consent before a use materially inconsistent with your privacy policy or the contract. A student can consent only if at least eighteen years old or legally emancipated (section 22-16-109(1) and (4)).
• Do not sell student personally identifiable information, except in an acquisition where the successor stays bound by the article. Do not use or share it for targeted advertising to students, and do not use it to build a personal profile of a student other than for purposes the contracting entity authorizes or with consent (section 22-16-109(2)).
• Disclose student personally identifiable information to a subcontractor only if you contractually require the subcontractor to comply with sections 22-16-108, 22-16-109, 22-16-110 and 22-16-111 (section 22-16-109(3)(b)).
• Maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information, using appropriate administrative, technological and physical safeguards (section 22-16-110(1)).
• Destroy a student's personally identifiable information as soon as practicable when the contracting public education entity requests it during the contract, unless the student or parent consents to retention or a receiving entity asks you to keep it. After the contract ends, destroy all of it within the period the contract specifies, or when it is no longer needed, and tell the entity the date of destruction (section 22-16-110(2) and (3)).

C.R.S. section 22-1-135 (HB 22-1252, as amended by HB 24-1450) · Read the law's page

• If you are a school district or other public school contracting entity, include in each public school contract the provisions section 22-1-135(2)(d) requires, among them a provision requiring the contractor to comply with the laws that protect personal identifying information, including student personal identifying information (C.R.S. 22-1-135(2)(d)(II)(B)).for a public body
• If you contract with a Colorado public school contracting entity to supply goods or services for a public school, comply with the laws that protect personal identifying information, including student personal identifying information, such as the federal Family Educational Rights and Privacy Act, the Student Data Transparency and Security Act, sections 6-1-713 and 6-1-713.5, article 73 of title 24 and the Colorado Privacy Act; your contract is deemed to require it even if the clause is omitted (C.R.S. 22-1-135(2)(d)(II)(B)).
• Do not rely on a public school contract term that waives, alters or limits those student data and privacy laws, requires the school entity to indemnify or hold anyone harmless, or binds it to arbitration: each such term is void, the rest of the contract stands, and Colorado law governs the contract (C.R.S. 22-1-135(2)(a) to (c)).

C.R.S. sections 22-32-150 and 22-30.5-529 (SB 25-143, 2025 Colo. Sess. Laws ch. 86) · Read the law's page

• If you are a school district, a school or a charter school of a school district, do not execute a contract with a vendor for the purchase of, or for services related to, a facial recognition service unless an exception in section 22-32-150(2) applies; an institute charter school is bound by the same rule in section 22-30.5-529.for a public body
• If you are a school or a school contractor using facial recognition under the educational-purposes exception, do not process a student's biometric identifier without the consent of the student and of the student's parent or legal guardian (the parent or legal guardian alone for a student in fifth grade or below), a staff member's biometric identifier without the staff member's consent, or any other individual's biometric identifier without that individual's consent and, if legally required, a parent's or legal guardian's consent (C.R.S. 22-32-150(2.5)(a)(I)).
• Obtain that consent on a form that is opt-in, stand-alone from other information and waivers, and that says a biometric identifier is being collected, what it will be used for, who will be in control of it and its retention schedule, either at the beginning of each school year or before use of the curriculum that collects it (C.R.S. 22-32-150(2.5)(a)(II) and (III)).
• If you are a school using facial recognition under the safety-circumstances exception, notify all students, parents and legal guardians and staff, and post notices at the entrances to school grounds that facial recognition services may be used on school grounds (C.R.S. 22-32-150(2.5)(b)(I)).when it serves a public body
• Use facial recognition in the safety circumstances only to identify and locate the specific individuals for, or reasonably believed connected to, the exempted circumstance, and disable it immediately upon identification and determining their location; a security-camera system that cannot be switched on and off without losing effectiveness may stay operational but must not identify anyone unless an exempted circumstance is actively occurring (C.R.S. 22-32-150(2.5)(b)(II) to (IV)).when it serves a public body
• If you are a school district, develop a policy governing the use of facial recognition technology that gives clear guidelines on access and oversight, designates the authorized personnel who alone may process facial recognition data, and allows searches only through a formal request process (C.R.S. 22-32-150(2.5)(b)(V)).for a public body
• If you are a school or a school contractor in possession of biometric identifiers, do not retain an individual's biometric identifier for longer than eighteen months (C.R.S. 22-32-150(2.5)(c)).

C.R.S. section 22-1-135(2)(d) and (2)(e), as amended by HB 25-1152 · Read the law's page

• If you contract with a Colorado school district or other public school contracting entity to supply goods, services or construction for a public school, comply with the accessibility standards for an individual with a disability that the Office of Information Technology adopted under section 24-85-103 (8 CCR 1501-11); the public school contract is deemed to require it even if the clause is omitted (C.R.S. 22-1-135(2)(d)(II)(C)).
• Indemnify, hold harmless and assume liability for the public school contracting entity, the public school and its employees and agents for all costs, claims, damages, court awards and attorney fees a school district incurs in relation to your noncompliance with those standards (C.R.S. 22-1-135(2)(d)(IV)).
• If the public school contracting entity requires it, have your compliance with those standards determined and attested to by a qualified third party it selects (C.R.S. 22-1-135(2)(e)).
• If you are a school district or other public school contracting entity, include these accessibility provisions in each public school contract you enter into, amend or renew on or after August 6, 2025 (C.R.S. 22-1-135(2)(d)).for a public body