Facial recognition services in Colorado schools: contracting prohibition, exceptions, consent, notice and retention limits

A school district, or a school or charter school of a school district, may not execute a contract with any vendor for the purchase of, or for services related to, any facial recognition service, except as the section provides. A contract in effect on the effective date of Senate Bill 25-143 is excepted from the prohibition.

A contract for a generally available consumer product, including a tablet or smartphone, that analyzes facial features to help the user manage an address book or still or video images for personal or household use is also excepted.

A contract with a school service contract provider for a product, device, or software application that allows for analysis of facial features for educational purposes in conjunction with curricula approved by the local school board of a school district is excepted from the prohibition.

A contract with a school service contract provider for a product, device, or software application that allows for analysis of facial features for educational purposes in conjunction with curricula approved by the charter school board is excepted from the prohibition for an institute charter school.

A contract with a school service contract provider for a product that allows the analysis of facial features is also excepted in three circumstances: a school official or law enforcement officer determines that an individual whose facial imaging has been obtained has made an articulable and significant threat against a school or its occupants and facial recognition may assist in keeping them safe; a student absconds or is reported lost or missing and there is a reasonable belief that facial recognition may assist in finding the student; or an individual ordered by a court or the school administration to stay off school district property has engaged in threatening or harassing behavior and is reasonably believed likely to try to reenter it.

Under an educational-purposes contract, the school or contractor may not process a student's biometric identifier without first obtaining the consent of the student and of the student's parent or legal guardian, and only the parent's or legal guardian's consent is required if the student is in fifth grade or below.

The school or contractor also may not process a staff member's biometric identifier without the staff member's consent, or any other individual's biometric identifier without that individual's consent and, if legally required, the consent of the individual's parent or legal guardian, on the same form.

The consent form must be opt-in, stand-alone from other information and waivers, include a notice that a biometric identifier is being collected, what it will be used for, and who will be in control of it, and include information about the retention schedule. Consent may be obtained at the beginning of each school year to cover all curriculum that collects biometric identifiers, or before use of that curriculum.

If a school has a contract under the safety-circumstances exception, the school must provide notice to all students, parents and legal guardians, and staff, and post notices at the entrances to school grounds that individuals may be subject to use of facial recognition services on school grounds.

In the safety circumstances, the facial recognition services must only be used to identify and locate the specific individual or individuals for the exempted circumstance and individuals reasonably believed to be connected to it. Once enabled, the facial recognition services must not be used for any other purpose and must be disabled immediately upon identification and determining the location of the individual or individuals in the exempted circumstance.

If the school contractor's technology cannot be enabled or disabled without decreasing its effectiveness, a school district that uses facial recognition technology through security cameras may keep the system operational at all times, but the system must not be used to actively or passively identify any individual unless one of the safety circumstances is actively occurring.

Where a missing student is determined to no longer be on school grounds, the facial recognition services must be disabled once the student's location, or last known location on school grounds, has been determined. Each school district must develop a policy governing the use of facial recognition technology, including clear guidelines on access and oversight.

The policy must designate the specific authorized personnel, such as school administrators and law enforcement officials, who may process facial recognition data in response to an articulable and significant threat against the school; no other individual may access or use the data, and facial recognition searches may only be conducted through a formal request process.

A school or school contractor in possession of biometric identifiers may not retain an individual's biometric identifier for longer than eighteen months. An aggrieved party may apply, in an action in the appropriate district court, for a temporary restraining order or injunction, or both, against a school, school employee or school contractor that is engaging in a practice that violates the section.

Before Senate Bill 25-143, subsection (4) of section 22-32-150 repealed the section effective July 1, 2025. Senate Bill 25-143 repealed that subsection. Senate Bill 25-143 took effect on April 18, 2025.