Law / United States / 
Colorado
Use of consent by employers: biometric identifiers of employees and prospective employees
C.R.S. section 6-1-1314(6) (HB 24-1130, 2024 Colo. Sess. Laws ch. 313)
In force since .
A biometric privacy rule binding private bodies.
- Obligation class
- Consent, Prohibition, Biometric
As of .
What it requires
- If you are an employer, require an employee or prospective employee to consent to your collecting and processing the person's biometric identifier as a condition of employment only to permit access to secure physical locations and secure electronic hardware and software applications, to record the start and end of the full work day including meal breaks and rest breaks over thirty minutes, to improve or monitor workplace safety or security or ensure the safety or security of employees, or to improve or monitor the safety or security of the public in an emergency or crisis (section 6-1-1314(6)(a)).
- Do not obtain an employee's or prospective employee's consent to retain biometric data that is used for current employee location tracking or for tracking how much time the employee spends using a hardware or software application (section 6-1-1314(6)(a)(I)).
- Collect and process an employee's or prospective employee's biometric identifier for any other use only with the person's consent, and do not require that consent as a condition of employment or retaliate against a person who does not give it (section 6-1-1314(6)(b)).
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 6-1-1311(1)(c) makes a violation of part 13 a deceptive trade practice for enforcement by the attorney general or a district attorney, and section 6-1-112(1)(a) sets a civil penalty of not more than $20,000 for each violation of any provision of article 1 of title 6, each consumer or transaction involved being a separate violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 20,000
Who enforces it
Enforcement body
Colorado Attorney General and the district attorneys, who have exclusive authority to enforce part 13 of article 1 of title 6 by an action in the name of the state or as parens patriae (section 6-1-1311(1)(a)).
Settledness
- As of
What this law does
Under section 6-1-1314(6)(a), an employer may require as a condition of employment that an employee or prospective employee consent to the employer's collection and processing of the person's biometric identifier only to permit access to secure physical locations and secure electronic hardware and software applications, to record the commencement and conclusion of the full work day, to improve or monitor workplace safety or security, or to improve or monitor public safety in an emergency or crisis.
Under section 6-1-1314(6)(a)(I), an employer may not obtain consent to retain biometric data used for current employee location tracking or for tracking how much time the employee spends using a hardware or software application.
Under section 6-1-1314(6)(b), an employer and its processor may collect and process an employee's or prospective employee's biometric identifier for other uses only with the person's consent, and the employer may not require that consent as a condition of employment or retaliate against a person who does not consent.
Section 6-1-1314(6)(d) does not restrict an employer's or its processor's collection and processing of a biometric identifier for uses aligned with the reasonable expectations of an employee based on the job description or role, or of a prospective employee based on a reasonable background check, an application or identification requirements.
Section 6-1-1311(1)(a) gives the attorney general and the district attorneys exclusive authority to enforce part 13 of article 1 of title 6, and section 6-1-1311(1)(b) provides that part 13 is not the basis for a private right of action. Section 6-1-1311(1)(c) makes a violation of part 13 a deceptive trade practice for enforcement by the attorney general or a district attorney.
Section 6-1-112(1)(a) makes a person who violates any provision of article 1 of title 6 liable to a civil penalty of not more than $20,000 for each violation, and each consumer or transaction involved is a separate violation. Under section 6-1-1314(6)(a)(II), an employer may require consent to collect the biometric identifier to record the commencement and conclusion of the employee's full work day, including meal breaks and rest breaks in excess of thirty minutes.
House Bill 24-1130 added section 6-1-1314 to the Colorado Privacy Act, effective , and applies to the collection, retention, processing and use of biometric identifiers and biometric data on and after that date.
When LexLint raises it
When your app profile says your app processes biometric data or makes employment decisions.