Law / United States / 
Colorado
SB 24-041 (2024), Privacy Protections for Children's Online Data
Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
What follows is LexLint's own research summary of this law, not legal advice.
In force 12 months, effective 1 October 2025.
An age-appropriate design code rule binding private bodies.
As of 15 July 2026.
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments.
Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed May 31, 2024.
If you get it wrong
Private right of actionNo
Penalties
Violations are deceptive trade practices under the Colorado Consumer Protection Act.
Who enforces it
Enforcement body
Colorado Attorney General and district attorneys
What it reaches
Age threshold
18
Covered services
Controllers offering any online service, product, or feature to Colorado consumers known or willfully disregarded to be minors, without the Colorado Privacy Act's usual volume thresholds.
Verification methods
Parental consent
When LexLint raises it
serves_minors
Read the law
official signed act text, Colorado General Assembly
Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.