On January 29, 2024, House Bill 24-1130 for an Act concerning protecting the privacy of an individual's biometric data was introduced to the Colorado House of Representatives. The bill would amend the Colorado Privacy Act (CPA) to add protections for biometric data by requiring data controllers to adopt a written policy that:  

• establishes a retention schedule for biometric identifiers;  

• includes a protocol for responding to a breach of security of biometric data; and 

• includes guidelines that require the permanent destruction of a biometric identifier.  

The bill also aims to:  

• prohibit data controllers from collecting a biometric identifier unless the controller first satisfies certain disclosure and consent requirements;  

• specify certain prohibited acts and requirements for data controllers that collect and use biometric data; 

• require a data controller to allow a consumer to access and update a biometric identifier; 

• restrict an employer's permissible reasons for obtaining an employee's consent for the collection of biometric identifiers; and  

• authorize the attorney general (AG) to promulgate rules to implement the bill. 

You can read the bill here and track its progress here. 

Update: February 21, 2024

Bill passes the House with amendments

On February 20, 2024, the bill passed the Colorado House with amendments after a third reading. The bill contains several amendments and additions regarding biometric data to include:

• increasing the time to destroy biometric data after receiving a verified request to 45 days from the original 30 days;
• prohibiting a data controller from buying biometric identifiers without fulfilling additional requirements;
• prohibiting the collection of biometric identifiers of employees or prospective employees by employers; and
• prohibiting a data controller from refusing the provision of a good or service if a data subject refuses to consent unless the collection of the biometric identifier is necessary for the good or service.

You can read the amended bill here and track its progress here.

Update: February 26, 2024

Bill introduced to the Colorado Senate

On February 23, 2024, the bill was introduced to the Colorado Senate and assigned to the Senate Judiciary Committee.

You can read the bill here and track its progress here. 

Update: April 19, 2024

Bill passes second reading in Senate

On April 18, 2024, the bill passed its second reading in the Senate. Previously, on April 15, 2024, the bill received amendments in the Senate Judiciary Committee after being assigned to the Judiciary Committee on March 27, 2024. 

You can read the amended bill here and track its progress here.

Update: April 22, 2024

Amended bill is considered by House after passing third reading in Senate

On April 20, 2024, the Colorado House of Representatives considered amendments to the bill. The House subsequently decided to lay the bill over for consideration at a later date. This follows the bill's passage in the Senate after its third reading on April 19, 2024.

You can read the bill here and track its progress here.

Update: May 29, 2024

Bill signed by legislature

On May 28, 2024, the bill was signed by the Speaker of the House and President of the Senate. Afterward, the bill was sent to the Governor of Colorado on the same date for signature. 

You can read the bill here and track its progress here.

Update: June 3, 2024

Bill signed by Governor into law

On May 31, 2024, the Act was signed by the Colorado Governor into law. The Act will take effect on July 1, 2025, unless an amendment is filed as described within the Act. 

You can read the signed Act here and view the legislative history here.