SB 24-041 CO

0likes☆Favorite🔕SubscribeShare

Became Law

Effective October 1. 2025, the act amends the "Colorado Privacy Act" to add enhanced protections when a minor's data is processed and there is a heightened risk of harm to minors. The act applies to any entity that controls consumer personal data (controller) and that conducts business in Colorado or delivers products or services that are targeted at Colorado residents, regardless of the volume of or amount of revenue derived from that activity. A controller that offers an online service, product, or feature to a consumer who the controller knows or willfully disregards is a minor is required to: Use reasonable care to avoid any heightened risk of harm to minors caused by the service, product, or feature; and Conduct, and review as necessary, a data protection assessment for the service, product, or feature if there is a heightened risk of harm to minors and maintain documentation regarding the assessment for a specified period. Unless the minor or, for a minor who is under 13 years of age, the minor's parent or legal guardian has consented, a controller is prohibited from processing a minor's personal data: For targeted advertising, selling the minor's personal data, or profiling in furtherance of decisions that produce legal or similarly significant consequences; For any processing purpose other than the purpose disclosed at the time the minor's personal data is collected or a purpose reasonably necessary for the disclosed processing purpose; or For longer than reasonably necessary to provide the service, product, or feature. Absent consent, a controller is also prohibited from: Using a system design feature to significantly increase, sustain, or extend a minor's use of the service, product, or feature; or Collecting a minor's precise geolocation, except under specified circumstances. Neither a controller nor a processor that processes personal data for a controller is required to implement an age verification or age-gating system or otherwise affirmatively verify the age of consumers, and a controller that conducts commercially reasonable age estimation is not liable for an erroneous age estimation. The attorney general and district attorneys are authorized to enforce the requirements of the act in the same manner as authorized under the "Colorado Privacy Act", including notifying a controller of, and allowing a controller time to cure, a violation. APPROVED by Governor May 31, 2024 EFFECTIVE October 1, 2025(Note: This summary applies to this bill as enacted.)

• Robert Rodriguez Democratic · primary
• Paul Lundeen · primary
• Lisa Frizell Republican · primary
• Javier Mabrey Democratic · primary

1. May 31, 2024 Governor Signed · executive
2. May 15, 2024 Sent to the Governor · executive
3. May 14, 2024 Signed by the Speaker of the House · lower
4. May 14, 2024 Signed by the President of the Senate · upper
5. May 6, 2024 Senate Considered House Amendments - Result was to Concur - Repass · upper
6. May 5, 2024 House Third Reading Passed - No Amendments · lower
7. May 4, 2024 House Second Reading Special Order - Passed with Amendments - Committee · lower
8. May 3, 2024 House Second Reading Laid Over Daily - No Amendments · lower
9. May 1, 2024 House Committee on Business Affairs & Labor Refer Amended to House Committee of the Whole · lower
10. Apr 23, 2024 Introduced In House - Assigned to Business Affairs & Labor · lower
11. Apr 23, 2024 Senate Third Reading Passed - No Amendments · upper
12. Apr 22, 2024 Senate Second Reading Passed with Amendments - Committee, Floor · upper
13. Apr 19, 2024 Senate Second Reading Laid Over to 04/22/2024 - No Amendments · upper
14. Apr 16, 2024 Senate Committee on Business, Labor, & Technology Refer Amended to Senate Committee of the Whole · upper
15. Jan 10, 2024 Introduced In Senate - Assigned to Business, Labor, & Technology · upper