The act requires an operator of a social media platform (operator) to ensure that its social media platform provides a streamlined process to allow law enforcement agencies to contact the social media platform. The process must be available to law enforcement agencies at all times and make available a staffed hotline for the purposes of:Receiving and responding to questions about search warrants;Acknowledging the receipt of a search warrant within 8 hours after receipt; andProviding status updates on search warrant compliance to a requesting law enforcement agency. With certain exceptions, an operator must comply with a search warrant within 24 hours if certain conditions apply. A court may reasonably extend this time if the court makes a written finding that the operator or social media platform has shown good cause for the extension and that an extension would not cause an adverse result. The act sets forth enforcement options for the attorney general and district attorneys regarding operators' compliance with search warrants. The act requires an operator to report to a social media platform user's (user's) local law enforcement agency within 24 hours if the operator's social media platform takes any one of certain described adverse actions against a user. A violation of the reporting requirement is a violation of the 'Colorado Consumer Protection Act'. In current law, 'social media platform' is defined as an internet-based service, website, or application that satisfies certain criteria, including having more than 100,000 active users in Colorado. The act removes this criterion. The act makes conforming amendments as necessary to Senate Bill 26-011, as enacted in the 2026 regular legislative session, to have Senate Bill 26-011 conform with the provisions of the act.(Note: This summary applies to this bill as enacted.)
In 2024, the general assembly enacted Senate Bill 24-205, which created consumer protections in interactions with artificial intelligence systems. The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions. The act defines an 'automated decision-making technology' (ADMT) as a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. The act defines a 'consequential decision' as a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits. The act requires the developer of an ADMT (developer) that is used to materially influence a consequential decision (covered ADMT), starting January 1, 2027, to provide a deployer of a covered ADMT (deployer) with technical documentation describing the covered ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers must notify deployers of material updates or modifications to the covered ADMT. Both developers and deployers are required to retain records necessary to demonstrate compliance with the act for at least 3 years. The act establishes consumer notice requirements, mandating that deployers provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. A deployer is required to provide a consumer with a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer. The attorney general must adopt rules to clarify these post-adverse outcome disclosure requirements by January 1, 2027. Consumers have the right to request personal data and correction of factually incorrect personal data used by a covered ADMT. The act also grants consumers the right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome. The attorney general is directed to enforce the act through the 'Colorado Consumer Protection Act', and a violation of the act is deemed a deceptive trade practice. Before initiating an action before January 1, 2030, the attorney general must provide the developer or deployer with a 60-day notice and opportunity to cure the alleged violation, if a cure is deemed possible. The act does not create a new private right of action but establishes how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law. Specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations.(Note: This summary applies to this bill as enacted.)
The act defines 3-dimensional printing to mean additive and subtractive manufacturing. The act prohibits knowingly manufacturing or producing a potentially functioning firearm, unfinished frame or receiver, large-capacity magazine, or rapid-fire device (firearm or firearm component) by 3-dimensional printing. The prohibition does not apply to a federally licensed firearm manufacturer, an instructor or student of an accredited gunsmithing program, or an institution that operates an accredited gunsmithing program. Unlawful 3-dimensional printing of a firearm or firearm component is a class 1 misdemeanor; except that a second or subsequent offense is a class 5 felony. The prohibitions in the act only apply to potentially functional firearms and firearm components.(Note: This summary applies to this bill as enacted.)
The act creates new requirements and civil remedies beginning June 1, 2027, related to individuals under 18 years old (minors) who are featured in compensated content on online hosting platforms (online content). A minor is considered to be engaged in content creation work if, over a 12-month period, the following 3 criteria are met:At least 30% of a content creator's online content produced within a 30-day period includes the minor's likeness, name, or photograph;The number of views of the online content meets the online hosting platform's compensation threshold or the content creator receives $0.10 or more per view, including compensation from sponsorships; andThe content creator receives at least $40,000 in actual compensation from the online content. Content creators whose online content features a minor engaged in content creation work must maintain specific records, including:Proof of the minor's age;The total compensation generated; andThe total number of minutes the minor was featured in posts featuring online content. A content creator shall compensate a minor engaged in content creation work by setting aside a portion of the gross earnings into a trust account for the minor until the minor reaches the age of majority or is declared emancipated. A court may distribute money from the trust account to the minor before the minor reaches the age of majority or is declared emancipated upon petition from the trustee and a finding that the money will only be used for specific expenses that solely benefit the minor. An adult or an emancipated minor who was featured as a uniquely identifiable minor in a content creator's post featuring online content on or after June 1, 2027, may request that the content creator delete the post or remove the uniquely identifiable information. The content creator must comply with the request within 72 hours. If the content creator fails to comply after 30 days, the individual may sue for various types of relief, and the online hosting platform must review and take reasonable steps to remove the content unless certain exceptions apply. The act prohibits a person from financially benefiting from knowingly producing or distributing online content of a minor with the intent to sexually gratify or elicit a sexual response in the viewer. Exceptions apply for law enforcement, reporting unlawful activity, legal proceedings, and certain actions engaged in by online hosting platforms. Online hosting platforms are required to develop and implement a risk-based strategy to help mitigate risks related to the monetization of the intentional sexualization of known minors. A civil action may be filed on behalf of a minor for damages, including actual damages, punitive damages, and attorney fees, if a content creator fails to comply with specified provisions of the act.(Note: This summary applies to this bill as enacted.)
The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves.Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety.The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.(Note: This summary applies to this bill as introduced.)
Beginning July 1, 2026, if a petitioner is under 18 years old at the time of filing a petition seeking to change the petitioner's name, the act requires the court to suppress the record unless the petitioner was previously convicted of a felony. The act authorizes the court to use the suppressed court record for administrative purposes, but the court is prohibited from publishing the petitioner's name or the petitioner's new name online. A petitioner who is under 18 years old is not required to give public notice of the name change. The act authorizes an individual to access a suppressed court record without a court order if the individual obtains verbal consent from a party to the case and submits an affidavit to the court, upon penalty of perjury, that the individual has obtained the verbal consent.(Note: This summary applies to this bill as enacted.)
Under the bill, a "covered business" is defined as a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate of such a legal entity, that:Conducts business in the state and generates a majority of its annual revenue from online services;Makes available online gaming services, products, or features that are reasonably likely to be accessed by a user who is a minor or who the covered business labels as a minor (covered minor);Collects users' personal data or has users' personal data collected on its behalf by a processor; andSolely or jointly with others determines the purposes and means of the processing of users' personal data. The bill states that a covered business that processes the personal data of a covered minor owes a minimum duty of care to the covered minor. The bill also requires a covered business to:Configure default privacy settings provided to a covered minor to the highest level of privacy and to include certain default settings;Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted and, if the business receives such a request, to honor it within 15 days; andImmediately delete all data that relates to the determination of a user's age after it is determined that the user is a covered minor. The bill prohibits a covered business from:Providing a covered minor with a single setting that makes all of the default privacy settings less protective at once;Requesting or prompting a covered minor to make their privacy settings less protective;Collecting, selling, sharing, or retaining personal data of a covered minor that is not necessary to provide an online gaming service, product, or feature with which the covered minor is actively and knowingly engaged;Using previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected;Permitting an individual to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked;Using the personal data of a covered minor to select, recommend, or prioritize media for the covered minor unless the covered minor makes certain requests or takes certain actions warranting such conduct by the covered business; orSending push notifications to a covered minor between 12 midnight and 6 a.m. The bill imposes additional specific requirements and prohibitions for a covered business that collects users' personal data for the purpose of conducting age assurance. The bill requires a covered business to ensure that the purchase price for an online gaming service, product, or feature that is made available through the covered business's online gaming service, product, or feature and that is reasonably likely to be accessed by a covered minor is listed in United States dollars at the point of sale. A covered business shall impose and collect a fee on each add-on transaction that is conducted by a covered minor through the covered business's online gaming service, product, or feature. The amount of the fee is 5% of the amount of the transaction. Money collected as such fees is credited to the state public school fund. The bill requires a social media platform to provide certain information on its website or mobile application concerning privacy policies and the use of algorithms. A social media platform is prohibited from using an algorithmic recommendation system to sell or otherwise distribute an illicit substance to a covered minor.(Note: This summary applies to this bill as introduced.)
The act requires operators of certain websites, online services, online applications, or mobile applications (covered platforms) to ensure that each covered platform provides a streamlined process to allow Colorado law enforcement agencies to contact the covered platform at all times. The process must, at a minimum, make available a staffed hotline for Colorado law enforcement agencies for the purposes of:Receiving and responding to questions about search warrants;Acknowledging the receipt of a search warrant within 8 hours after receipt; andProviding status updates on search warrant compliance to a requesting Colorado law enforcement agency. An operator must comply with a search warrant within 72 hours after receiving the search warrant if certain conditions apply. A court may reasonably extend this time if the court makes a written finding that the operator or covered platform has shown good cause for the extension and that an extension would not cause an adverse result. The failure of an operator or a covered platform to comply with the requirements of a court-ordered search warrant supports a finding of contempt of court. The attorney general or a district attorney with jurisdiction may enforce the act.(Note: This summary applies to this bill as enacted.)
