Colorado (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Colorado Privacy Act (CPA) | C.R.S. §§ 6-1-1301 to 6-1-1314 | In force | 1 July 2023 |
| Notification of security breach | C.R.S. § 6-1-716 | In force | 1 September 2006 |
| Colorado Artificial Intelligence Act (SB 24-205), as amended by SB 25B-004 | C.R.S. §§ 6-1-1701 to 6-1-1707 (2024 version) | In force | 30 June 2026 |
| Automated decision-making technology in consequential decisions (SB 26-189) | C.R.S. §§ 6-1-1701 to 6-1-1709, as repealed and re-enacted by SB 26-189 | Enacted, not yet in force | 1 January 2027 |
| Conversational artificial intelligence service operator requirements (HB 26-1263) | C.R.S. § 6-1-1708 (2026 Colo. Sess. Laws ch. 208, HB 26-1263) | Enacted, not yet in force | 1 January 2027 |
| Age attestation on computing devices (SB 26-051) | C.R.S. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343) | Enacted, not yet in force | 1 July 2028 |
- Colorado Privacy Act (CPA): Amended for biometric data (from 1 July 2025), minors (from 1 October 2025) and precise geolocation (SB 25-276, 2025). The link is the legislature’s 2024 compilation; the official C.R.S. is published by LexisNexis.
- Colorado Artificial Intelligence Act (SB 24-205), as amended by SB 25B-004: Duties for developers and deployers of high-risk AI systems, first set to start on 1 February 2026 and moved to 30 June 2026 by SB 25B-004 (approved 28 August 2025). SB 26-189 repeals and replaces this version from 1 January 2027, so on the face of the statutes it applies from 30 June to 31 December 2026.
- Automated decision-making technology in consequential decisions (SB 26-189): Repeals and re-enacts the 2024 Colorado AI Act (SB 24-205). Under its § 5, the new part 17 takes effect on 1 January 2027 and applies to consequential decisions made from then; only its rulemaking parts took effect on passage. The Attorney General must adopt rules before 1 January 2027.
- Conversational artificial intelligence service operator requirements (HB 26-1263): Signed 29 May 2026. From 1 January 2027, operators of public AI chatbots must say they’re AI, run a suicide and self-harm protocol with crisis referrals, not present answers as those of licensed professionals, and protect minors. Yearly reports to the Attorney General start on 1 July 2027.
- Age attestation on computing devices (SB 26-051): An app that receives an age signal is treated as knowing the user’s age range. Civil penalties are up to $2,500 per minor harmed by a negligent violation and $7,500 per minor harmed by an intentional one.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses, including non-profits, that operate in Colorado or target its residents and control or process data of 100,000 or more Colorado consumers a year, or earn revenue or discounts from selling data of 25,000 or more. Any controller handling biometric data must follow the biometric rules, and the minors’ rules apply regardless of size. GLBA financial institutions, air carriers and HIPAA data are exempt. Employees, job applicants and B2B contacts aren’t consumers, but employers may require biometric consent only for set purposes such as secure access and timekeeping.
Sources: coag.gov/resources/colorado-privacy-act · leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
Lawful bases
Section titled “Lawful bases”There are no GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data, and to opt out of targeted advertising, sale and significant-decision profiling, within 45 days. Opt-in consent is needed for sensitive data (including biological and neural data and, since 2025, precise geolocation within 1,850 feet), for selling it, and for new purposes. Agreement obtained through dark patterns or by accepting broad terms doesn’t count as consent.
Sources: coag.gov/resources/colorado-privacy-act · leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf · leg.colorado.gov/sites/default/files/2025a_276_signed.pdf
Consent age for online services
Section titled “Consent age for online services”A child is under 13, and a parent must consent before the child’s data is processed (COPPA consent counts). Since 1 October 2025, a minor is anyone under 18. If a controller knows or wilfully disregards that a user is a minor, it needs the minor’s consent (a parent’s if under 13) before targeted advertising, sale or significant profiling.
Sources: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf · leg.colorado.gov/sites/default/files/2024a_041_signed.pdf
Children
Section titled “Children”Since 1 October 2025, online services that know or wilfully disregard a minor’s age must take reasonable care against heightened risk of harm; without consent they can’t use engagement-extending features or collect precise geolocation, and adults’ unsolicited messages need safeguards. From 1 January 2027, AI chatbot operators must estimate users’ age and, for known minors, guard against sexual content and replies simulating emotional dependence, with no random rewards to boost engagement. From 1 July 2028, apps must request an operating-system age signal, which counts as knowing the age range.
Sources: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf · leg.colorado.gov/sites/default/files/2024a_041_signed.pdf · leg.colorado.gov/laws/session-laws/HB26-1263/208/download · coag.gov/resources/ai · leg.colorado.gov/laws/session-laws/SB26-051/343/download
Cookies and similar technologies
Section titled “Cookies and similar technologies”There’s no cookie-consent rule. Consumers can opt out of targeted advertising and sale, and since 1 July 2024 covered businesses must honour a universal opt-out mechanism. Global Privacy Control is the one the Attorney General recognises. Privacy notices must explain how these requests are handled.
Sources: coag.gov/uoom · coag.gov/resources/colorado-privacy-act
Electronic marketing
Section titled “Electronic marketing”Colorado’s Spam Reduction Act makes breaking federal CAN-SPAM a deceptive trade practice, and email providers can sue for $1,000 per unlawful message. Telemarketers must register with the state’s no-call program and must not call numbers on the Colorado no-call list. Calls and texts are otherwise governed by the federal TCPA.
Sources: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
Breach notification
Section titled “Breach notification”Notify affected Colorado residents in the most expedient time possible and no later than 30 days after determining that a breach occurred. If 500 or more residents are affected, tell the Attorney General within the same 30 days. If more than 1,000 must be notified, also tell the nationwide credit bureaus.
Sources: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
Registration and fees
Section titled “Registration and fees”The CPA requires no registration or fee.
Sources: coag.gov/resources/colorado-privacy-act
Data protection officer
Section titled “Data protection officer”There’s no requirement to appoint a data protection officer.
Sources: coag.gov/resources/colorado-privacy-act
International transfers
Section titled “International transfers”Colorado law sets no restrictions on transferring personal data abroad; federal rules are in us-federal.
Sources: coag.gov/resources/colorado-privacy-act
Impact assessments
Section titled “Impact assessments”Conduct and document a data protection assessment before targeted advertising, selling personal data, processing sensitive data, or profiling that risks unfair treatment, injury or intrusion. Online services for minors with a heightened risk of harm need their own assessment. The Attorney General’s CPA Rules (4 CCR 904-3) set the content, and the Attorney General can ask for assessments.
Sources: coag.gov/resources/colorado-privacy-act · leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of significant-decision profiling. On the face of the statutes, the 2024 AI Act’s duties for high-risk AI systems apply from 30 June to 31 December 2026. From 1 January 2027, SB 26-189 replaces it. Deployers of automated decision tools used in decisions on jobs, education, housing, lending, insurance, health care or government services must give notice, explain adverse outcomes within 30 days and offer correction and human review, workers and applicants included. Developers must document their tools. Chatbot rules (HB 26-1263) also start in 2027.
Sources: leg.colorado.gov/bill_files/116432/download · leg.colorado.gov/sites/default/files/2025b_004_signed.pdf · coag.gov/resources/ai · leg.colorado.gov/bills/HB26-1263 · leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf
Penalties
Section titled “Penalties”The Attorney General and district attorneys enforce the CPA as a deceptive trade practice, with civil penalties up to $20,000 per violation (counted per consumer or transaction) and $50,000 if against an elderly person. The general cure period ended on 1 January 2025; one for the minors’ rules lasts until 31 December 2026. From 2027 the Attorney General alone enforces SB 26-189, also as a deceptive trade practice, with a 60-day cure unless a violation is knowing or repeated (until 1 January 2030). There’s no private right of action.
Sources: leg.colorado.gov/sites/default/files/images/olls/crs2024-title-06.pdf · coag.gov/resources/colorado-privacy-act · leg.colorado.gov/bill_files/116432/download
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-co.yaml.