Colorado

No person may distribute, publish, broadcast, or display a communication about a candidate for elective office that includes a deepfake within 60 days of a primary or 90 days of a general election, unless the communication carries a specified clear and conspicuous disclosure that it has been edited and falsely appears authentic. This binds any distributing party, not only the AI system's provider or deployer, and is unaffected by the litigation and repeal touching SB 24-205 and SB 26-189.

An operator that develops and makes publicly available, or offers to a consumer, a conversational artificial intelligence service must use commercially reasonable or generally accepted methods to estimate a user's age, and must not willfully disregard clear and convincing information that an account holder or user is a minor.

Starting January 1, 2027, if an operator knows an account holder or user is a minor, the operator must disclose that the service is artificial intelligence, withhold unpredictable-interval engagement rewards from the minor, prevent the service from producing explicit sexual content, intimate digital depictions, or statements simulating romantic companionship or emotional dependence with the minor, and give the minor and a parent or guardian tools to manage privacy and account settings.

Starting January 1, 2027, an operator must also disclose to every user, not only minors, that the service is artificial intelligence, run a suicide and self-harm response protocol that refers a user to a crisis service provider rather than law enforcement, and not represent the service's output as coming from a licensed health-care, legal, or mental-health professional or a qualified dietitian; starting July 1, 2027, it must report annually to the Attorney General on crisis referrals and self-harm safeguards without including user-identifying information.

Signed May 29, 2026 as Chapter 208 and added to Part 17 of Title 6 alongside SB 24-205 and SB 26-189, a violation of this duty is a deceptive trade practice under the Colorado Consumer Protection Act enforced by the Colorado Attorney General, subject to a 60-day right to cure before an enforcement action, and creates no new private right of action.

Prior to using a covered automated decision-making technology that materially influences a consequential decision (education, employment, housing, financial or lending services, insurance, health care, or essential government services), a deployer must provide a clear and conspicuous notice that it used or will use covered ADMT in that decision, satisfiable by a prominent public notice at points of consumer interaction.

If the ADMT produces an adverse outcome, the deployer must, within 30 days, provide a plain-language description of the decision and the technology's role, plus an explanation of the consumer's rights. Signed 14 May 2026; the consumer disclosure duty itself takes effect 1 January 2027, so it is enacted, not yet in force, as of the date shown. The Colorado General Assembly's own bill status page confirms the 14 May 2026 signature date.

Amends the Colorado Privacy Act to define biometric identifier (a fingerprint, a voiceprint, a scan or record of an eye retina or iris, a facial map, facial geometry, or facial template, or another unique biological, physical, or behavioral pattern) and biometric data, and adds C.R.S. 6-1-1314, which requires any controller that controls or processes a biometric identifier, regardless of the CPA's general size thresholds, to give notice and obtain consent before collection, adopt a written retention and destruction policy, maintain a data-security-incident response protocol, and refrain from selling, leasing, or trading a biometric identifier absent consent or a listed exception.

Consumers may request the source, purpose, and third-party disclosures of their biometric data. The biometric-data definition excludes a photograph and an audio or video recording, and data generated from either, but only conditionally: the exclusion drops away the moment that data is used for identification purposes, so a voiceprint or faceprint extracted from a recording specifically to identify someone remains covered.

Requires a person or commercial entity that maintains computerized personal identifying information of Colorado residents to notify affected residents of a security breach in the most expedient time possible, without unreasonable delay, and within 30 days of determining a breach occurred, subject to a delay while a law-enforcement investigation is pending.

A breach affecting 500 or more residents must also be reported to the Colorado Attorney General; one affecting more than 1,000 residents must also be reported to nationwide consumer reporting agencies. A separate statute, C.R.S. 24-73-103, covers a governmental entity's own breach-notification duty. HB 24-1130 cross-references this section for the biometric-specific breach-response protocol a controller's written policy must include.

Colorado's omnibus data-privacy statute requires a controller that conducts business in or intentionally targets Colorado residents, and meets a 100,000-consumer or a 25,000-consumer-plus-sale-revenue threshold, to give consumers notice, minimize collection, obtain affirmative opt-in consent before processing sensitive data or resuming processing after an opt-out, and honor rights to access, correct, delete, and port personal data.

Processors must follow controller instructions and assist with compliance, and a controller must complete a data protection assessment before processing that presents a heightened risk of harm.

Amends the Colorado Privacy Act's sensitive-data definition to add biological data (data from technological processing, measurement, or analysis of an individual's biological, genetic, biochemical, physiological, or neural properties, used or intended for identification) and neural data (information generated by measuring central or peripheral nervous system activity, processed by or with a device).

Extends the CPA's opt-in consent duty for sensitive data to both categories, the first such extension to neural data in a US comprehensive privacy statute.

Amends the Colorado Privacy Act to add a duty of care: a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid a heightened risk of harm to that minor, and must complete a data protection assessment where that risk exists.

Absent opt-in consent (from the minor, or a parent or guardian for a minor under 13), the controller may not process a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects, use a system design feature meant to significantly increase, sustain, or extend a minor's use of the service, or collect a minor's precise geolocation data beyond what is necessary to provide the service.

The minors' provisions keep their own 60-day cure notice requirement in force through December 31, 2026, after the CPA's general cure period sunset on January 1, 2025.

Subsection (1)(a) makes it a cybercrime for a person to knowingly access a computer without authorization, exceed authorized access, or use a computer without authorization or in excess of authorized access, language that tracks the federal Computer Fraud and Abuse Act (CFAA)'s structure almost verbatim rather than California's broader without permission standard.

No Colorado court has construed this language in a scraping context, so whether Colorado would follow the narrow, gates-based reading the US Supreme Court gave the federal statute in Van Buren v. United States (593 U.S. 374, 2021) is unsettled as a matter of Colorado law.

A 2018 act (HB 18-1200, session law chapter 379, confirmed against the official signed act) renamed the section from computer crime to cybercrime and added the current subsections (1)(h) through (1)(j) and an escalated penalty tier; a 2023 act (HB 23-1293, confirmed against the official signed act) amended only the repeat-offender penalty clause at (3)(b), not the underlying conduct definition at (1)(a).

The underlying text is confirmed directly against the official Colorado Revised Statutes (leg.colorado.gov): the section's own source note shows the article was entire added in 1979, subsection (1) was amended in 1983, and the entire section was reenacted in 2000; no amendment since 2000 has touched subsection (1)(a) itself, so the currently codified without-authorization or exceeds-authorized-access language traces to that 2000 reenactment rather than to the 1979 original.

Section 6-1-1303(17) excludes publicly available information from personal data, defined with only two prongs: information lawfully made available from a federal, state, or local government record, and information the controller has a reasonable basis to believe the consumer has lawfully made available to the general public.

Unlike California's CCPA, there is no third widely-distributed-media catch-all and no prong for information a third party disclosed without restricting the audience, so personal data a scraper pulls from a source that is neither a government record nor the data subject's own post, such as an aggregator or people-search broker, falls outside the exemption and inside the Act's reach for a qualifying collector.

HB 24-1130 (2024), effective July 1, 2025, added Section 6-1-1303(2.2), defining biometric data as one or more biometric identifiers used for identification purposes and excluding a bare digital or physical photograph, an audio or video recording, or data generated from one, unless used for identification; and (2.4), a separate term, biometric identifier, meaning data generated by measuring a person's unique biological, physical, or behavioral characteristics, such as a fingerprint, voiceprint, retina or iris scan, or facial geometry.

Biometric or genetic data processed to uniquely identify an individual is sensitive data under Section 6-1-1303(24)(b), triggering opt-in consent; scraping a raw photo or voice clip is not itself scraping biometric data, but processing it into an identification template is.

Section 6-1-105 lists specific deceptive trade practices, and paragraph (1)(rrr) reaches anyone who knowingly or recklessly engages in any unfair, unconscionable, deceptive, deliberately misleading, false, or fraudulent act or practice, broad language structurally comparable to California's UCL.

No Colorado scraping case has ever been brought under this statute, and no Colorado case applies common-law trespass to chattels to a scraping fact pattern either, so whether Colorado would require actual system harm, as California does post-Hamidi, or a lower showing, is unsettled. Paragraph (1)(rrr) is a 2022 addition, confirmed against the official Colorado Revised Statutes: HB 22-1287 repealed the former paragraph (1)(kkk) and added the current (1)(rrr) in its place.

A covered entity that maintains paper or electronic documents containing personal identifying information during the course of business must develop a written policy for the destruction or proper disposal of those documents. Once the documents are no longer needed, the covered entity must destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable through any means.

"Covered entity" and "personal identifying information" carry the same definitions this section shares with the reasonable-security-procedures duty at C.R.S. 6-1-713.5, and a covered entity already regulated by state or federal law and following that regulator's own disposal procedures is deemed compliant.

Unless an entity specifically contracts with a recycler or disposal firm for destruction, the recycler or disposal firm has no duty to verify that the documents it receives were properly destroyed.

A covered entity, a person that maintains, owns, or licenses personal identifying information of a Colorado resident in the course of its business, vocation, or occupation, must implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information from unauthorized access, use, modification, disclosure, or destruction.

Personal identifying information is defined narrowly: a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device.

Where a covered entity discloses that information to a third-party service provider, it must require the provider to implement and maintain its own reasonable security procedures, unless the covered entity retains primary responsibility and implements technical controls that protect the information. A covered entity already regulated by state or federal law and following that regulator's own data-security procedures is deemed compliant.

This duty binds a private person or commercial entity; a governmental entity's parallel duty sits at C.R.S. 24-73-102, outside this profile's private-sector scope.

Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments.

Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed May 31, 2024.

Requires operating system providers and covered application stores to let an account holder indicate a birth date, age, or age bracket at device setup and to share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers, who must treat the signal as the primary indicator of a user's age range unless they have clear and convincing information otherwise. Signed June 3, 2026; codified as article 30 of title 6 (Age Attestation for Online Users).