Colorado

A deployer of a covered automated decision-making technology must retain, for not less than three years after the date of a consequential decision or for a longer period if state or federal law requires, records reasonably necessary to demonstrate compliance with Part 17 of Title 6 of the Colorado Revised Statutes. The records may include the technology's version identifiers, changelogs, and documentation of material mitigation changes. The Act takes effect on January 1, 2027.

HB 26-1139 takes effect on 1 January 2027 as Chapter 325 of the 2026 Colorado session laws. The Governor signed it on 2 June 2026. From that date, entities that use an AI system to conduct utilization review of health-care services, including carriers, pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations and managed care entities, must ensure that the AI system complies with the act's requirements.

The system must make determinations based on medical or clinical history and individual clinical circumstances, must not rest solely on group data, must not be used in a discriminatory way, and must be periodically assessed for accuracy and reliability. An entity must disclose to the applicable state agency the utilization review functions for which the system will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information.

A carrier's denial of coverage based in whole or in part on medical necessity may not be issued solely on the output of an AI system without human review by a licensed clinician or physician or other competent regulated professional. The act also bars a carrier and a public-program payer from paying for psychotherapy services conducted directly with a client by an AI system.

An insurer authorized to do business in Colorado that offers individually issued life insurance, private passenger automobile insurance, or a health benefit plan, and that uses an external consumer data and information source (ECDIS), or an algorithm or predictive model that uses one, in any insurance practice, must establish a documented, risk-based governance and risk management framework, including a cross-functional governance group, designed to determine through quantitative testing whether that use results in unfair discrimination with respect to race, and to remediate any discrimination detected.

An insurer that does not use ECDIS instead files a signed officer attestation. The Division of Insurance adopted the original version of this regulation for life insurers alone effective November 14, 2023, under the authority of C.R.S. 10-1-109 and 10-3-1104.9; this amended version, effective October 15, 2025, extends the same framework to private passenger automobile insurers and health benefit plan insurers, with a July 1, 2026 deadline for those two lines' first compliance report.

An insurer may not unfairly discriminate based on race, color, national or ethnic origin, religion, sex, sexual orientation, disability, gender identity, or gender expression in any insurance practice, and, once the Commissioner of Insurance adopts implementing rules for a type of insurance, may not use an external consumer data and information source (ECDIS), or an algorithm or predictive model that uses one, in a way that has that same discriminatory effect.

The duty does not reach title insurance, a surety bond, or most commercial insurance policies, though it does reach a business owners' or commercial general liability policy carrying an annual premium of ten thousand dollars or less. The Commissioner's implementing rules for a given insurance type are Division of Insurance Regulation 10-1-1 (3 CCR 702-10), held as its own instrument in this topic.

No person may distribute, publish, broadcast, or display a communication about a candidate for elective office that includes a deepfake within 60 days of a primary or 90 days of a general election, unless the communication carries a specified clear and conspicuous disclosure that it has been edited and falsely appears authentic. This binds any distributing party, not only the AI system's provider or deployer, and is unaffected by the litigation and repeal touching SB 24-205 and SB 26-189.

Prior to using a covered automated decision-making technology that materially influences a consequential decision (education, employment, housing, financial or lending services, insurance, health care, or essential government services), a deployer must provide a clear and conspicuous notice that it used or will use covered ADMT in that decision, satisfiable by a prominent public notice at points of consumer interaction.

If the ADMT produces an adverse outcome, the deployer must, within 30 days, provide a plain-language description of the decision and the technology's role, plus an explanation of the consumer's rights. Signed 14 May 2026. The consumer disclosure duty itself takes effect 1 January 2027. The Colorado General Assembly's own bill status page confirms the 14 May 2026 signature date.

On and after January 1, 2027, a developer must make available to each deployer of a covered automated decision-making technology it developed a general statement of the technology's intended uses and known harmful or inappropriate uses, a description of the categories of data used to train it, its known limitations, and instructions for appropriate use, monitoring and meaningful human review.

The developer must also make available the information reasonably necessary for the deployer to comply with the deployer disclosure section, and must notify the deployer if information is withheld. A developer must give each deployer notice of material updates, intentional and substantial modifications, and changes to the intended use of, limitations for, or risk mitigation for the technology within a reasonable time.

These disclosure duties apply only to a deployer's use of a technology that was marketed, advertised, configured, contracted, sold or licensed to be used to materially influence a consequential decision.

A developer must retain, for not less than three years after the creation of a record required or created under the section, or for a longer period if state or federal law requires, records reasonably necessary to demonstrate compliance, including system version identifiers, changelogs, and documentation and notices of material updates provided to deployers. The Act takes effect on January 1, 2027.

Amends the Colorado Privacy Act to define biometric identifier (a fingerprint, a voiceprint, a scan or record of an eye retina or iris, a facial map, facial geometry, or facial template, or another unique biological, physical, or behavioral pattern) and biometric data, and adds C.R.S. 6-1-1314, which requires any controller that controls or processes a biometric identifier, regardless of the CPA's general size thresholds, to give notice and obtain consent before collection, adopt a written retention and destruction policy, maintain a data-security-incident response protocol, and refrain from selling, leasing, or trading a biometric identifier absent consent or a listed exception.

Consumers may request the source, purpose, and third-party disclosures of their biometric data. The biometric-data definition excludes a photograph and an audio or video recording, and data generated from either, but only conditionally: the exclusion drops away the moment that data is used for identification purposes, so a voiceprint or faceprint extracted from a recording specifically to identify someone remains covered.

Under section 6-1-1314(6)(a), an employer may require as a condition of employment that an employee or prospective employee consent to the employer's collection and processing of the person's biometric identifier only to permit access to secure physical locations and secure electronic hardware and software applications, to record the commencement and conclusion of the full work day, to improve or monitor workplace safety or security, or to improve or monitor public safety in an emergency or crisis.

Under section 6-1-1314(6)(a)(I), an employer may not obtain consent to retain biometric data used for current employee location tracking or for tracking how much time the employee spends using a hardware or software application.

Under section 6-1-1314(6)(b), an employer and its processor may collect and process an employee's or prospective employee's biometric identifier for other uses only with the person's consent, and the employer may not require that consent as a condition of employment or retaliate against a person who does not consent.

Section 6-1-1314(6)(d) does not restrict an employer's or its processor's collection and processing of a biometric identifier for uses aligned with the reasonable expectations of an employee based on the job description or role, or of a prospective employee based on a reasonable background check, an application or identification requirements.

Section 6-1-1311(1)(a) gives the attorney general and the district attorneys exclusive authority to enforce part 13 of article 1 of title 6, and section 6-1-1311(1)(b) provides that part 13 is not the basis for a private right of action. Section 6-1-1311(1)(c) makes a violation of part 13 a deceptive trade practice for enforcement by the attorney general or a district attorney.

Section 6-1-112(1)(a) makes a person who violates any provision of article 1 of title 6 liable to a civil penalty of not more than $20,000 for each violation, and each consumer or transaction involved is a separate violation. Under section 6-1-1314(6)(a)(II), an employer may require consent to collect the biometric identifier to record the commencement and conclusion of the employee's full work day, including meal breaks and rest breaks in excess of thirty minutes.

House Bill 24-1130 added section 6-1-1314 to the Colorado Privacy Act, effective July 1, 2025, and applies to the collection, retention, processing and use of biometric identifiers and biometric data on and after that date.

Requires a person or commercial entity that maintains computerized personal identifying information of Colorado residents to notify affected residents of a security breach in the most expedient time possible, without unreasonable delay, and within 30 days of determining a breach occurred, subject to a delay while a law-enforcement investigation is pending.

A breach affecting 500 or more residents must also be reported to the Colorado Attorney General; one affecting more than 1,000 residents must also be reported to nationwide consumer reporting agencies. A separate statute, C.R.S. 24-73-103, covers a governmental entity's own breach-notification duty. HB 24-1130 cross-references this section for the biometric-specific breach-response protocol a controller's written policy must include.

The Colorado Privacy Act Rules, 4 CCR 904-3, are the Attorney General's implementation and operational guidelines for the Colorado Privacy Act. The rules took effect on July 1, 2023, with amendments effective January 30, 2025 and, for Rules 2.02, 6.13, 6.14 and 7.03 B.3, December 1, 2025. A controller that receives an opt-out request through a Universal Opt-Out Mechanism must treat it as a valid request to opt out of targeted advertising, the sale of personal data, or both.

A controller must keep records of consumer data rights requests for at least 24 months. A controller must give any required biometric identifier notice at or before the initial collection or processing of a biometric identifier. A controller must conduct and document a data protection assessment before it starts a processing activity that presents a heightened risk of harm to a consumer.

A request to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects must be honored where the profiling rests on solely automated processing or human reviewed automated processing. Personal data must be processed with reasonable and appropriate administrative, technical, organizational and physical safeguards.

An employer may require an employee or prospective employee to consent to biometric collection and processing as a condition of employment only as the Colorado Privacy Act permits.

Colorado's omnibus data-privacy statute requires a controller that conducts business in or intentionally targets Colorado residents, and meets a 100,000-consumer or a 25,000-consumer-plus-sale-revenue threshold, to give consumers notice, minimize collection, obtain affirmative opt-in consent before processing sensitive data or resuming processing after an opt-out, and honor rights to access, correct, delete, and port personal data.

Processors must follow controller instructions and assist with compliance, and a controller must complete a data protection assessment before processing that presents a heightened risk of harm. SB 25-276 (chapter 240 of the 2025 Colorado session laws) took effect on May 23, 2025. It defines precise geolocation data as information derived from technology that accurately identifies the present or past location of a device that links or is linkable to an individual within a radius of 1,850 feet.

It makes precise geolocation data sensitive data. It also bars a controller from selling a consumer's sensitive data without the consumer's consent.

Section 25-1-801 reaches every patient record in the custody of a health facility licensed or certified under section 25-1.5-103(1) or article 3 of title 25, or of an entity regulated under title 10 that provides health-care services.

Under sections 25-1-801 and 25-1-802, such a record must be available for inspection to the patient or the patient's personal representative through the attending health-care provider at reasonable times and on reasonable notice, except records withheld under 45 CFR 164.524(a).

Under section 25-1-801, a health-care facility must provide copies of a patient's medical records to the patient or the patient's personal representative on request and payment of the fee a covered entity may impose under Health Insurance Portability and Accountability Act (HIPAA), or to a third person who submits a HIPAA-compliant authorization, valid subpoena or court order.

Under section 25-1-801, a health-care facility must deliver the medical records in electronic format if the person requests it, the originals are stored in electronic format and the records are readily producible that way. Under section 25-1-801, a health-care facility may not charge a fee for the inspection of medical records.

Section 25-1-802 reaches every patient record in the custody of a podiatrist, chiropractor, dentist, doctor of medicine or osteopathy, nurse, optometrist, physical therapist or other provider it lists who is required to be licensed under title 12, or of a person practicing psychotherapy under article 245 of title 12.

Under section 25-1-802, a health-care provider must provide the medical records in electronic format if the person requests it, the originals are stored in electronic format and the records are readily producible that way. Under section 25-1-802, a health-care provider may not charge a fee for the inspection of medical records.

Section 25-1-801 does not require a person responsible for the diagnosis or treatment of sexually transmitted infections, a substance use disorder or drug use in the case of minors to release those records to a parent, guardian or other person than the minor or the minor's designated representative. House Bill 24-1360 (chapter 324 of the 2024 session laws) amended section 25-1-801(5)(c)(II)(A), effective July 1, 2024. Sections 25-1-801 and 25-1-802 were added in 1976 as part 8 of article 1 of title 25 and took effect on July 1, 1976.

The regulation governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the Colorado Division of Insurance.

A licensee must provide a clear and conspicuous initial notice that accurately reflects its privacy policies and practices to a customer not later than when the licensee establishes a customer relationship, and to a consumer before the licensee discloses any nonpublic personal financial information about the consumer to any nonaffiliated third party, other than as Sections 16 and 17 authorize.

A licensee must provide a clear and conspicuous notice to customers that accurately reflects its privacy policies and practices not less than annually during the continuation of the customer relationship.

A licensee may not, directly or through any affiliate, disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has provided the consumer an initial notice and an opt out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.

A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer, and an authorization may not remain valid for more than twenty-four months.

A licensee shall not unfairly discriminate against a consumer or customer because that person has opted out from the disclosure of nonpublic personal financial information or has not granted authorization for the disclosure of nonpublic personal health information. The regulation does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The regulation is effective January 14, 2018.

Under section 10-16-423, a health maintenance organization must hold in confidence any data or information about the diagnosis, treatment or health of an enrollee or applicant that it obtains from that person or from a provider.

Under section 10-16-423, a health maintenance organization may not disclose that information to any person except as necessary to carry out the insurance code provisions on health maintenance organizations, on the express consent of the enrollee or applicant, under a statute or court order, in a claim or litigation between that person and the organization, or as state or federal law otherwise requires or permits.

Under section 10-16-423, a health maintenance organization may claim any statutory privilege against disclosure that the provider who furnished the information is entitled to claim. Sections 10-3-1107 and 10-3-1108 let the commissioner of insurance hold a hearing when the commissioner has reason to believe a person has violated any other provision of title 10, and order a monetary penalty of not more than $3,000 for each act or violation, up to $30,000 in the aggregate.

Section 10-16-423 was reenacted with article 16 of title 10 in 1992 and amended in 2003. No day on which the section came into force has been located.

Under section 6-1-715 of the Colorado Revised Statutes, a person or entity may not publicly post or publicly display an individual's social security number in any manner, print it on a card the individual needs to access products or services, or require the individual to transmit it over the internet unless the connection is secure or the number is encrypted.

Under section 6-1-715 of the Colorado Revised Statutes, a person or entity may not require an individual to use a social security number to access an internet website unless a password, unique personal identification number or other authentication device is also required.

Under section 6-1-715 of the Colorado Revised Statutes, a person or entity may not print an individual's social security number on materials mailed to the individual unless state or federal law requires, permits or authorizes it.

Under section 6-1-715 of the Colorado Revised Statutes, a person or entity that used a social security number before January 1, 2007 in a manner subsection (1) bars may continue that use only if the use is continuous, and subsection (1) applies again if the use stops for any reason. Under section 6-1-715 of the Colorado Revised Statutes, a person or entity continuing such a use must also give the individual an annual disclosure that the individual has the right to stop it.

Under section 6-1-715 of the Colorado Revised Statutes, a person or entity continuing such a use must implement a written request to stop the use within 30 days after receipt, may not charge a fee for doing so, and may not deny services because the individual makes the request. Section 6-1-715 does not prevent the collection, use or release of a social security number as required, permitted or authorized by state or federal law, or its use for internal verification or administrative purposes.

Section 6-1-715 does not apply to documents or records that are recorded or required to be open to the public under the constitution or laws of the state, or to an entity subject to the federal Health Insurance Portability and Accountability Act of 1996. Section 6-1-103 of the Colorado Revised Statutes makes the attorney general and the district attorneys concurrently responsible for enforcing article 1 of title 6.

Section 6-1-112(1)(a) of the Colorado Revised Statutes makes a person who violates any provision of article 1 of title 6 liable to a civil penalty of not more than $20,000 for each violation, and each consumer or transaction involved is a separate violation. Section 6-1-715 took effect on January 1, 2007.

Section 10-3-1104.6 binds an entity, meaning any sickness and accident insurance company, health maintenance organization, nonprofit hospital, medical-surgical and health service corporation, or other entity that provides health care insurance or medicare supplement insurance coverage and is subject to the jurisdiction of the commissioner of insurance.

Under section 10-3-1104.6, genetic information is confidential and privileged, and a release for purposes other than diagnosis, treatment or therapy that identifies the person tested with the test results requires specific written consent by that person or the person's parent or guardian.

Under section 10-3-1104.6, an entity that receives genetic information may not seek, use or keep it for any nontherapeutic purpose or for any underwriting purpose connected with health care insurance or medicare supplement insurance coverage. Under section 10-3-1104.6, an entity may not request or require an individual or a family member to undergo a genetic test unless state or federal law authorizes it.

A violation of section 10-3-1104.6 is an unfair practice under section 10-3-1104(1) of the Colorado Revised Statutes and is subject to the commissioner's powers in sections 10-3-1106 to 10-3-1113. Section 10-3-1108(1)(a) lets the commissioner, after a hearing, order a monetary penalty of not more than $3,000 for each act or violation, up to $30,000 in the aggregate, and for an insurer that knew or should have known of the violation not more than $30,000 for each act, up to $750,000 annually.

Under section 10-3-1104.6, an individual injured by an entity's violation may recover equitable relief and the greater of actual damages or $10,000 per violation. Under section 10-3-1104.6, the prevailing party in an action under the section may recover costs and reasonable attorney fees. House Bill 09-1338, which added section 10-3-1104.6, takes effect July 1, 2009 and applies to policies and contracts issued, delivered, renewed or reinstated on or after that date.

Section 10-3-1104.7 binds an entity, meaning any entity that provides group disability insurance or long-term care insurance coverage and is subject to the jurisdiction of the commissioner of insurance.

Under section 10-3-1104.7 of the Colorado Revised Statutes, information derived from genetic testing is confidential and privileged, and a release for purposes other than diagnosis, treatment or therapy that identifies the person tested with the test results requires that person's specific written consent.

Under section 10-3-1104.7 of the Colorado Revised Statutes, an entity that receives information derived from genetic testing may not seek, use or keep it for any nontherapeutic purpose or for any underwriting purpose connected with group disability insurance or long-term care insurance coverage.

Under section 10-3-1104.7 of the Colorado Revised Statutes, for life insurance or individual disability insurance the only requirements on an insurer are that it not require or perform a genetic test without the specific, written, informed consent of the subject of the test, and that it keep the results privileged and confidential.

A violation of section 10-3-1104.7 is an unfair practice under section 10-3-1104(1) of the Colorado Revised Statutes and is subject to the commissioner's powers in sections 10-3-1106 to 10-3-1113. Section 10-3-1108(1)(a) lets the commissioner, after a hearing, order a monetary penalty of not more than $3,000 for each act or violation, up to $30,000 in the aggregate, and for an insurer that knew or should have known of the violation not more than $30,000 for each act, up to $750,000 annually.

Under section 10-3-1104.7 of the Colorado Revised Statutes, an individual injured by an entity's violation may recover equitable relief and the greater of actual damages or $10,000 per violation. Section 10-3-1104.7 was amended in 2002, with subsection (10) effective June 1, 2002, and in 2009 by House Bill 09-1338, which amended subsections (1)(d), (2)(a), (3)(b) and (12)(a), effective July 1, 2009, so the current entity scope and the underwriting bar in subsection (3)(b) date from 2009. Section 10-3-1104.7 was added in 1994 and took effect on June 2, 1994.

Amends the Colorado Privacy Act's sensitive-data definition to add biological data (data from technological processing, measurement, or analysis of an individual's biological, genetic, biochemical, physiological, or neural properties, used or intended for identification) and neural data (information generated by measuring central or peripheral nervous system activity, processed by or with a device).

Extends the CPA's opt-in consent duty for sensitive data to both categories, the first such extension to neural data in a US comprehensive privacy statute.

Amends the Colorado Privacy Act to add a duty of care: a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid a heightened risk of harm to that minor, and must complete a data protection assessment where that risk exists.

Absent opt-in consent (from the minor, or a parent or guardian for a minor under 13), the controller may not process a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects, use a system design feature meant to significantly increase, sustain, or extend a minor's use of the service, or collect a minor's precise geolocation data beyond what is necessary to provide the service.

The minors' provisions keep their own 60-day cure notice requirement in force through December 31, 2026, after the CPA's general cure period sunset on January 1, 2025.

Under the Student Data Transparency and Security Act, a school service is an internet website, online service, online application or mobile application that is designed and marketed primarily for use in a preschool, elementary school or secondary school, is used at the direction of teachers or other employees of a local education provider, and collects, maintains or uses student personally identifiable information.

Under the Student Data Transparency and Security Act, a school service contract provider must give each public education entity it contracts with clear, layperson information on the data elements of student personally identifiable information it collects, the learning purpose of the collection, and how the information is used and shared.

Under the Student Data Transparency and Security Act, on discovering a misuse or unauthorized release of student personally identifiable information, the provider must notify the contracting public education entity as soon as possible.

Under the Student Data Transparency and Security Act, a school service contract provider may collect, use and share student personally identifiable information only for the purposes the contract authorizes or with the consent of the student or the student's parent.

Under the Student Data Transparency and Security Act, a school service contract provider may not sell student personally identifiable information, except in an acquisition of the provider where the successor stays bound by the article.

Under the Student Data Transparency and Security Act, a school service contract provider may not use or share student personally identifiable information for targeted advertising to students, or use it to create a personal profile of a student other than for supporting purposes the contracting entity authorizes or with consent.

Under the Student Data Transparency and Security Act, a school service contract provider must maintain a comprehensive information security program reasonably designed to protect the security, privacy, confidentiality and integrity of student personally identifiable information.

Under the Student Data Transparency and Security Act, after a contract ends the provider must destroy all student personally identifiable information collected, generated or inferred under it, within the period the contract specifies, and notify the public education entity of the date.

Under the Student Data Transparency and Security Act, a local education provider may not enter into or renew a contract with a school service contract provider that refuses the terms requiring compliance with sections 22-16-108 to 22-16-110, or that has substantially failed to comply with them.

Under the Student Data Transparency and Security Act, if a student's parent finds that a local education provider does not comply with the article, the parent may submit a complaint to the provider's governing board under its complaint policy. The Student Data Transparency and Security Act takes effect on the day following the ninety-day period after final adjournment of the General Assembly, which it gives as August 10, 2016 if adjournment sine die is on May 11, 2016.

Subsection (1)(a) makes it a cybercrime for a person to knowingly access a computer, computer network, or computer system without authorization, exceed authorized access, or use one without authorization or in excess of authorized access, and subsection (3)(b) makes that offense a class 2 misdemeanor.

Subsection (1)(e) separately covers altering, damaging, or interrupting a computer or its data without authorization or in excess of authorized access, and subsection (1)(g) covers software that runs automated tasks over the internet to circumvent or disable electronic queues, waiting periods, or other technological measures intended to limit the number of event tickets one person may buy.

Subsection (5) provides that an individual may authorize an agent to access and process, on the individual's behalf, personal data or other information held on a computer that is otherwise accessible to the individual, and that an authorized agent remains liable for unauthorized activity under applicable unfair competition laws, the federal Computer Fraud and Abuse Act, and the other provisions of the section.

Section 6-1-1303(17) excludes publicly available information from personal data, defined with only two prongs: information lawfully made available from a federal, state, or local government record, and information the controller has a reasonable basis to believe the consumer has lawfully made available to the general public.

The definition has no widely-distributed-media catch-all and no prong for information a third party disclosed without restricting the audience, so personal data a scraper pulls from a source that is neither a government record nor the data subject's own post, such as an aggregator or people-search broker, falls outside the exemption and inside the Act's reach for a qualifying collector.

HB 24-1130 (2024), effective July 1, 2025, added Section 6-1-1303(2.2), defining biometric data as one or more biometric identifiers used for identification purposes and excluding a bare digital or physical photograph, an audio or video recording, or data generated from one, unless used for identification; and (2.4), a separate term, biometric identifier, meaning data generated by measuring a person's unique biological, physical, or behavioral characteristics, such as a fingerprint, voiceprint, retina or iris scan, or facial geometry.

Biometric or genetic data processed to uniquely identify an individual is sensitive data under Section 6-1-1303(24)(b), triggering opt-in consent; scraping a raw photo or voice clip is not itself scraping biometric data, but processing it into an identification template is.

Section 6-1-105 lists specific deceptive trade practices that a person commits in the course of the person's business, vocation, or occupation, and paragraph (1)(rrr) reaches a person who either knowingly or recklessly engages in any unfair, unconscionable, deceptive, deliberately misleading, false, or fraudulent act or practice. Paragraph (1)(rrr) is a 2022 addition: HB 22-1287 repealed the former paragraph (1)(kkk) and added the current (1)(rrr) in its place.

A covered entity that maintains paper or electronic documents containing personal identifying information during the course of business must develop a written policy for the destruction or proper disposal of those documents. Once the documents are no longer needed, the covered entity must destroy or arrange for their destruction by shredding, erasing, or otherwise modifying the personal identifying information to make it unreadable or indecipherable through any means.

"Covered entity" and "personal identifying information" carry the same definitions this section shares with the reasonable-security-procedures duty at C.R.S. 6-1-713.5, and a covered entity already regulated by state or federal law and following that regulator's own disposal procedures is deemed compliant.

Unless an entity specifically contracts with a recycler or disposal firm for destruction, the recycler or disposal firm has no duty to verify that the documents it receives were properly destroyed.

A covered entity, a person that maintains, owns, or licenses personal identifying information of a Colorado resident in the course of its business, vocation, or occupation, must implement and maintain reasonable security procedures and practices, appropriate to the nature of the information and the nature and size of the business, to protect personal identifying information from unauthorized access, use, modification, disclosure, or destruction.

Personal identifying information is defined narrowly: a Social Security number, a personal identification number, a password or pass code, a state driver's license or identification card number, a government passport number, biometric data, an employer, student, or military identification number, or a financial transaction device.

Where a covered entity discloses that information to a third-party service provider, it must require the provider to implement and maintain its own reasonable security procedures, unless the covered entity retains primary responsibility and implements technical controls that protect the information. A covered entity already regulated by state or federal law and following that regulator's own data-security procedures is deemed compliant.

This duty binds a private person or commercial entity; a governmental entity's parallel duty sits at C.R.S. 24-73-102, outside this profile's private-sector scope.

Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments.

Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed May 31, 2024.

Requires operating system providers and covered application stores to let an account holder indicate a birth date, age, or age bracket at device setup and to share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers, who must treat the signal as the primary indicator of a user's age range unless they have clear and convincing information otherwise. Signed June 3, 2026; codified as article 30 of title 6 (Age Attestation for Online Users).

Requires a social media platform with more than 100,000 active Colorado users to give users under 18 information on how social media affects the developing brain and youth mental and physical health, and to display a notification every 30 minutes once a minor has spent one hour on the platform in a 24 hour period or is using it between 10 p.m. and 6 a.m. Signed June 6, 2024, with the platform requirement set for January 1, 2026, but preliminarily enjoined before that date.

The order enjoins Section 4 of the Act, which is section 6-1-1601. The school resource bank in section 22-2-127.8 is a separate part of the Act that the order does not enjoin. Colorado has appealed the injunction to the Tenth Circuit.