SB 24-041, Protecting Minors' Online Data

C.R.S. sections 6-1-1305.5, 6-1-1308.5, 6-1-1309.5, 6-1-1311(1)(d)(II) (2024 Colo. Sess. Laws ch. 296)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 12 months, effective 1 October 2025.

A sensitive categories rule binding private bodies.

As of 23 August 2026.

What it requires

If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.
Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.
Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Amends the Colorado Privacy Act to add a duty of care: a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid a heightened risk of harm to that minor, and must complete a data protection assessment where that risk exists.

Absent opt-in consent (from the minor, or a parent or guardian for a minor under 13), the controller may not process a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects, use a system design feature meant to significantly increase, sustain, or extend a minor's use of the service, or collect a minor's precise geolocation data beyond what is necessary to provide the service.

The minors' provisions keep their own 60-day cure notice requirement in force through December 31, 2026, after the CPA's general cure period sunset on January 1, 2025.

When LexLint raises it

deploys_chatbot
automated_outreach
high_risk_decisions
crawls_web

Read the law

Official enrolled act text, 2024 Colo. Sess. Laws ch. 296 (SB 24-041), and the Colorado General Assembly's official bill page

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app