Law / United States / 
Colorado
SB 26-051 (2026), Age Attestation on Computing Devices Act
Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343)
An app store age verification (AV) rule binding private bodies.
What it requires
- Applies to operating system providers, covered application stores and application developers; broadband internet access service, telecommunications service and open source operating systems are excluded.
- As an operating system provider or covered application store, let an account holder indicate a birth date, age or age bracket at device setup, and share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers.NIST Privacy FrameworkCT.PO-P2
- As an application developer, treat the signal as the primary indicator of a user's age range unless you have clear and convincing information otherwise.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalty up to $2,500 per minor for a negligent violation and up to $7,500 per minor for an intentional violation, with a good faith compliance defense for erroneous age signals.
Who enforces it
Enforcement body
Colorado Attorney General
Settledness
- As of
- Open questions
- Is a covered application deemed under Section 6-30-102(3)(b)(I) to know the age range of a person other than the device's 'primary user' who uses the application on the same device?
- What counts as 'clear and convincing information' under Section 6-30-102(3)(b)(II) and (III) that a user's age differs from the age signal, and must a developer act on a user's own statement of age?
What it reaches
Age threshold
18
Covered services
Operating system providers, covered application stores, and application developers, excluding broadband internet access service, telecommunications service, and open source operating systems.
Verification methods
Self declaration, Device signal
What this law does
Requires operating system providers and covered application stores to let an account holder indicate a birth date, age, or age bracket at device setup and to share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers, who must treat the signal as the primary indicator of a user's age range unless they have clear and convincing information otherwise. Signed ; codified as article 30 of title 6 (Age Attestation for Online Users).
When LexLint raises it
When your app profile says your app operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .