Law / United States / 
Colorado
HB 24-1130, Privacy of Biometric Identifiers and Data
C.R.S. sections 6-1-1303(2.2)-(2.4), 6-1-1314 (2024 Colo. Sess. Laws ch. 313)
In force since .
A biometric privacy rule binding private bodies.
- Private right of action
- No
- Excludes recording-derived identifiers
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- none
What it requires
- Before collecting a Colorado resident's biometric identifier such as a fingerprint, voiceprint, or facial geometry template, disclose in a clear and accessible manner what is collected, why, and how long it will be kept, and obtain the consumer's consent, whatever your app's overall personal-data processing volume.NIST Privacy FrameworkCM.AW-P1NIST Privacy FrameworkCT.PO-P1
- Adopt and publish a written policy that sets a retention schedule and a destruction timeline (the earliest of purpose satisfied, 24 months after the consumer's last interaction, or 45 days, extendable by up to 45 more, after the identifier is no longer needed) and a data-security-incident response protocol.NIST Privacy FrameworkCT.PO-P2NIST Privacy FrameworkPR.PO-P7
- Do not sell, lease, or trade a biometric identifier, or disclose one to a third party, without the consumer's consent or a listed statutory exception.NIST Privacy FrameworkCT.PO-P1
- A voiceprint or facial template you generate from a photo, audio, or video recording for the purpose of identifying someone is covered biometric data even though the underlying photo or recording itself is excluded when not used that way.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- PR.PO-P7Response plans (Incident Response and Business Continuity) and recovery plans (Incident Recovery and Disaster Recovery) are established, in place, and managed.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a controller that passively receives a voice recording from a third party "collect" a biometric identifier under C.R.S. 6-1-1314(1)(a) when it later extracts a voiceprint from that recording?
What it makes you log
Logging duty
The act defines biometric identifier and biometric data and adds section 6-1-1314. A controller must adopt a written policy with a retention schedule, an incident-response protocol and deletion guidelines (including a review at least once a year of whether storage is still necessary), and must give notice before collection, obtain consent, and answer a consumer's request for the source, purpose and recipients of the biometric data. These are policy, notice and disclosure duties, and the act requires no log or record of events and no audit or regulator access to a record. The only territorial text is the scope of the access right in subsection (5)(b), which reaches an entity that conducts business in Colorado or markets to Colorado residents; the "conducts business" prong is not coded as a hook value.
- Kind
- None
- As of
What this law does
Amends the Colorado Privacy Act to define biometric identifier (a fingerprint, a voiceprint, a scan or record of an eye retina or iris, a facial map, facial geometry, or facial template, or another unique biological, physical, or behavioral pattern) and biometric data, and adds C.R.S. 6-1-1314, which requires any controller that controls or processes a biometric identifier, regardless of the CPA's general size thresholds, to give notice and obtain consent before collection, adopt a written retention and destruction policy, maintain a data-security-incident response protocol, and refrain from selling, leasing, or trading a biometric identifier absent consent or a listed exception.
Consumers may request the source, purpose, and third-party disclosures of their biometric data. The biometric-data definition excludes a photograph and an audio or video recording, and data generated from either, but only conditionally: the exclusion drops away the moment that data is used for identification purposes, so a voiceprint or faceprint extracted from a recording specifically to identify someone remains covered.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .