Law / United States / 
Colorado
SB 24-041 (2024), Privacy Protections for Children's Online Data
Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
In force since .
An age-appropriate design code rule binding private bodies.
- Private right of action
- No
- Penalties
- Violations are deceptive trade practices under the Colorado Consumer Protection Act.
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Produced on request
What it requires
- Applies to a controller offering any online service, product or feature to a Colorado consumer it actually knows or willfully disregards is a minor (under 18), without the Colorado Privacy Act's usual volume thresholds.
- Use reasonable care to avoid a heightened risk of harm to minors.no control in the NIST Privacy Framework
- Conduct data protection assessments.NIST Privacy FrameworkID.RA-P4
- Without consent (the minor's, or a parent's for a child under 13), do not process a minor's data for targeted advertising, sale or significant profiling.NIST Privacy FrameworkCT.PO-P1
- Without that consent, do not use a system design feature to significantly increase, sustain or extend the minor's use.no control in the NIST Privacy Framework
- Without that consent, do not collect precise geolocation except as specified.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Colorado Attorney General and district attorneys
Settledness
The Department of Law filed proposed draft amendments to the Colorado Privacy Act Rules on to clarify the changes made by Senate Bill 24-041.
- As of
- Open questions
- What facts show that a controller 'willfully disregards' that a consumer is a minor under Section 6-1-1308.5(1)(a), given that Section 6-1-1304(3)(f) does not require a controller to collect the age of consumers?
- What does 'reasonable care to avoid any heightened risk of harm to minors' require of a controller under Section 6-1-1308.5(1)(a), beyond the data protection assessment that Section 6-1-1309.5 requires?
What it reaches
Age threshold
18
Covered services
Controllers offering any online service, product, or feature to Colorado consumers known or willfully disregarded to be minors, without the Colorado Privacy Act's usual volume thresholds.
How the hook was established
express
What makes it apply
Operator establishment, Market targeting
Verification methods
Parental consent
What it makes you log
Who may demand the log
Regulator
Log retention
The period is the longer of three years after the processing operations cease or the date the controller ceases offering the service, product or feature.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
The duty is to document and keep the assessment of a service offered to known minors, not a log of age checks. Section 6-1-1304(3)(f) says the act does not require an age verification or age-gating system.
- Kind
- Implicit
- As of
- Provision
- C.R.S. 6-1-1309.5(2)(b): maintain documentation concerning a data protection assessment for the longer of three years after the processing operations cease or the date the controller stops offering the service; 6-1-1309.5(6)(b)(I): make the assessment available to the Attorney General on request
- Trigger
- personal_data_processing
What this law does
Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments.
Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed .
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .