Law / United States / 
Colorado
SB 24-041, Protecting Minors' Online Data
In force since .
A sensitive categories rule binding private bodies.
- Private right of action
- No
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.NIST Privacy FrameworkID.RA-P5NIST Privacy FrameworkID.RA-P4
- Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.NIST Privacy FrameworkCT.PO-P1
- Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.NIST Privacy FrameworkCT.DP-P4NIST Privacy FrameworkGV.PO-P2
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- What does a controller "willfully disregard" about whether a consumer "is a minor" under C.R.S. 6-1-1308.5(1)(a), and what amounts to "reasonable care to avoid any heightened risk of harm to minors"?
What it makes you log
Who may demand the log
Regulator
Log retention
The longer of three years after the processing operations cease or the date the controller stops offering the online service, product or feature.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
From a controller that offers an online service, product or feature to a consumer it knows or willfully disregards to be a minor, and finds a heightened risk of harm to minors, must conduct a data protection assessment, review it as needed for a material change, and maintain documentation of it for the longer of three years after the processing ends or the date the controller stops offering the service. The assessment is confidential and exempt from public inspection, and the controller must make it available to the Attorney General on request. The section lists what the assessment must address (purpose, categories of minors' data, purposes of processing, foreseeable risk) and none of those is an event field, so no log contents are coded. The "conducts business in Colorado" prong of section 6-1-1304(1)(b) is not coded as a hook value; the targeting prong is.
- Kind
- Explicit
- As of
- Provision
- C.R.S. 6-1-1309.5(1), (2)(b) and (6)(b) as added by SB 24-041 (a data protection assessment for an online service offered to a known minor, documentation kept, assessment produced to the Attorney General on request)
- Trigger
- personal_data_processing
What this law does
Amends the Colorado Privacy Act to add a duty of care: a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid a heightened risk of harm to that minor, and must complete a data protection assessment where that risk exists.
Absent opt-in consent (from the minor, or a parent or guardian for a minor under 13), the controller may not process a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects, use a system design feature meant to significantly increase, sustain, or extend a minor's use of the service, or collect a minor's precise geolocation data beyond what is necessary to provide the service.
The minors' provisions keep their own 60-day cure notice requirement in force through , after the CPA's general cure period sunset on .
When LexLint raises it
When your app profile says your app serves under-18s, makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .