Law / United States / 
Colorado
Colorado Privacy Act, publicly-available-information exemption and biometric data (as amended by HB 24-1130)
C.R.S. §§ 6-1-1301 et seq., 6-1-1303(2.2), (2.4), (17), (24)
In force since .
A personal data rule binding private bodies.
- Audit expectation
- none
What it requires
- Do not treat personal data scraped from an aggregator, people-search site, or re-hosted directory as publicly available under the Colorado Privacy Act; the exemption reaches only a government record or the consumer's own disclosure.
- Track biometric data (a usable identifier) and biometric identifier (the raw measured characteristic) as two separate defined terms, at Section 6-1-1303(2.2) and (2.4) respectively.
- Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.
These lines are LexLint's reading of the law's text. Also read by: Colorado Attorney General (guidance, recorded ).
In the frameworks
- NIST AI RMF
- MAP 1.6System requirements (e.g., “the system shall respect the privacy of its users”) are elicited from and understood by relevant AI actors. Design decisions take socio-technical implications into account to address AI risks.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://coag.gov/resources/colorado-privacy-act/
- Guidance body
- Colorado Attorney General
- Open questions
- What facts give a controller a 'reasonable basis to believe' under C.R.S. section 6-1-1303(17) that a consumer lawfully made information available to the general public, when the controller scraped it from a site the consumer did not post to?
What it makes you log
Logging duty
The row is limited to the definitions in section 6-1-1303 (2.2), (2.4), (17) and (24), which state no duty to create, keep or produce a record. The Act's data protection assessment duty and the Attorney General's access to assessments sit in section 6-1-1309, and its consumer definition (a Colorado resident) in section 6-1-1303(6) and applicability in section 6-1-1304; the row does not cite them. The signed Senate Bill 21-190 text the row cites does not contain paragraphs (2.2) and (2.4), which the 2024 biometric amendment added.
- Kind
- None
- As of
What this law does
Section 6-1-1303(17) excludes publicly available information from personal data, defined with only two prongs: information lawfully made available from a federal, state, or local government record, and information the controller has a reasonable basis to believe the consumer has lawfully made available to the general public.
The definition has no widely-distributed-media catch-all and no prong for information a third party disclosed without restricting the audience, so personal data a scraper pulls from a source that is neither a government record nor the data subject's own post, such as an aggregator or people-search broker, falls outside the exemption and inside the Act's reach for a qualifying collector.
HB 24-1130 (2024), effective , added Section 6-1-1303(2.2), defining biometric data as one or more biometric identifiers used for identification purposes and excluding a bare digital or physical photograph, an audio or video recording, or data generated from one, unless used for identification; and (2.4), a separate term, biometric identifier, meaning data generated by measuring a person's unique biological, physical, or behavioral characteristics, such as a fingerprint, voiceprint, retina or iris scan, or facial geometry.
Biometric or genetic data processed to uniquely identify an individual is sensitive data under Section 6-1-1303(24)(b), triggering opt-in consent; scraping a raw photo or voice clip is not itself scraping biometric data, but processing it into an identification template is.
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .