Technology

The bill amends the "Colorado Local Government Election Code" (local code) and the "Colorado Municipal Election Code of 1965" to add authorization for special districts and municipalities to use electronic ballot return in elections under the local code. Electronic ballot return allows a voter to return a marked ballot to the designated election official or clerk using a qualified electronic transmission system. A qualified electronic transmission system must:Provide for secure identification and authentication;Transmit encrypted information over a secure network;Protect the privacy, anonymity, and integrity of each elector's ballot;Protect against abuse; andProvide any additional security or other measures identified as necessary in the rules of the secretary of state.The designated election official or clerk is responsible for ensuring electronic ballot returns are anonymously transcribed to paper ballots, counted, and secured pursuant to the law for all ballots. Any electronic data generated by an elector using the electronic transmission system is confidential. The secretary of state is required to publish guidance and may also adopt rules as necessary to further specify the qualifications for an electronic transmission system used for electronic ballot return.(Note: This summary applies to this bill as introduced.)

The bill provides personal data privacy protections for consumers relating to homeowner's insurance transactions.     The bill establishes standards for an insurer, insurance producer, or surplus line insurer (licensee), and the director, officer, or agent of the licensee, as well as a processor on behalf of a licensee, relating to the use of a consumer's personal data. A licensee or processor is prohibited from processing a consumer's personal data for purposes unrelated to a homeowner's insurance transaction, selling personal data, or engaging in targeted advertising or joint marketing of cobranded financial products without first obtaining the consumer's affirmative consent to any of those practices by exercising the right to opt in to those practices. Affiliates of licensees are subject to the same requirements as licensees with respect to processing personal data.     A consumer's personal data is defined in the bill, in part, as data that identifies, relates to, describes, or is capable of being associated with a particular consumer or household and includes, among other data, a consumer's name, unique personal identifier, account number, social security number, property records, products or services purchased, account logins, information regarding the consumer's interactions with an internet application, loss history information, credit report, insurance score, insurance policy number and expiration date, and racial and ethnic origin. Personal data does not include de-identified data and publicly available data.     A consumer has the right to confirm whether a licensee is processing the consumer's personal data, to access the consumer's personal data, and to request a correction or amendment of inaccurate or incomplete personal data or the deletion of personal data that is not needed for the homeowner's insurance transaction or for specific products or services for which the consumer has given their consent.     The bill requires a licensee to provide a consumer with a data privacy notice that includes the consumer's rights with respect to personal data, including the right to know whether and with whom personal data is being shared, the type and sources of personal data being collected, and the right to opt in to the sharing or sale of personal data. The bill prohibits a licensee from retaliating against a consumer with respect to the provision of homeowner's insurance and the terms of the insurance if the consumer does not consent to opt in to certain actions relating to their personal data.     The bill requires a licensee to:Enter into a contract with a processor to ensure that those processing personal data on behalf of the licensee are complying with the consumer data privacy protections; andHave a retention policy to ensure that a consumer's personal data is deleted when it is no longer necessary for the insurance or other products or services to which the consumer has consented.     Additionally, if a licensee makes an adverse underwriting decision relating to a consumer's request for homeowner's insurance, the licensee must provide the consumer with the specific reasons for the adverse decision and allow the consumer to review the specific data relating to the adverse decision and to correct the data if appropriate. The bill prohibits a licensee from denying insurance based solely on the loss history of the previous owner of the property, or based solely on personal data received from a processor whose primary source of information is licensees, without the licensee obtaining further information that supports the adverse decision.     A consumer aggrieved by a violation of the consumer data privacy protections in the bill may bring a civil action in court and may be awarded damages for each violation, including treble damages if proved by clear and convincing evidence that the person violating the bill engaged in bad faith conduct or intentionally violated the consumer data privacy protection provisions of the bill.     In addition, the bill makes a violation of the bill an unfair or deceptive act or practice in the business of insurance and gives the commissioner of insurance the power to enforce the bill through actions against licensees and the assessment of civil penalties.(Note: This summary applies to this bill as introduced.)

The act defines a 'conversational artificial intelligence service' as an artificial intelligence system that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications.     Effective January 1, 2027, the act creates requirements and prohibitions for a person, partnership, corporation, or entity that develops and makes publicly available a conversational artificial intelligence service or offers a conversational artificial intelligence service to a consumer (operator).     An operator is required to use commercially reasonable methods or generally accepted methods to estimate the age of a consumer who has or opens an account or profile to use a conversational artificial intelligence service (account holder) and the age of other users of a conversational artificial intelligence service. If an operator knows that an account holder or user is a minor, an operator is:Required to provide certain disclosures;Prohibited from providing the minor account holder or minor user with points or rewards to encourage engagement with the conversational artificial intelligence service;Required to institute technically feasible measures to prevent the conversational artificial intelligence service from producing explicit sexual conduct, intimate digital depictions, or statements that simulate emotional dependence;Required to implement a protocol for a conversational artificial intelligence service to stop engaging in response to a user prompt regarding sexual conduct with a minor; andRequired to provide tools for the minor account holder or minor user or a parent or guardian of the minor account holder or minor user to manage the minor account holder's or minor user's privacy and account settings.     The act also requires an operator to provide a disclosure to a user that a conversational artificial intelligence service is artificial intelligence, implement a protocol for user prompts regarding suicidal ideation or self-harm, and annually report to the attorney general's office information regarding the protocol the operator is implementing. The act prohibits an operator from stating that any output data provided by a conversational artificial intelligence service is provided by, endorsed by, or equivalent to services provided by certain licensed or certified professionals.     The act clarifies that nothing in the act limits an individual's ability to access certain information and resources pursuant to the state constitution, requires an operator to disclose confidential information, or authorizes content moderation practices inconsistent with the United States constitution.(Note: This summary applies to this bill as enacted.)

The act prohibits using an automated driving system to drive a commercial motor vehicle unless an individual who holds a commercial driver's license is in the vehicle, monitors the vehicle's driving, and intervenes, if necessary, to avoid illegal or unsafe driving. The individual must be in the driver's seat if hazardous materials are being transported. The penalty is $1,000 for a first offense, is $2,000 for a second offense, and doubles for each subsequent offense.     The act does not apply to a light-duty vehicle or a truck-mounted attenuator.     The prohibition is repealed September 1, 2031. The chief of the Colorado state patrol will analyze the act's effects on commercial vehicle safety on highways. By November 1, 2030, the chief of the Colorado state patrol will issue a report to the relevant committees of the house of representatives and senate. The report must make recommendations as whether to continue the prohibition and, if continued, any recommended legislation to improve the prohibition.     For the 2026-27 state fiscal year, $14,357 is appropriated to the department of revenue from the Colorado DRIVES vehicle services account in the highway users tax fund to implement the act.(Note: This summary applies to this bill as enacted.)

Surveillance data is defined in the act as data that is obtained through observation, inference, or surveillance of consumers or workers and that is related to personal characteristics, online behaviors, or biometrics of an individual or group, band, class, or tier to which the individual belongs. The definition of 'worker' in the act excludes federal and state employees and employees of public entities.     The act prohibits discrimination against a consumer or worker resulting from the use of a price or wage setting algorithm (PWSA) that uses statistical modeling, data analytics, artificial intelligence, or other data processing techniques to analyze surveillance data, the output of which is a substantial factor in:Individualized price setting used to determine the amount charged to a consumer; orIndividualized wage setting used to determine the wage offered to a worker.     The act specifies activities that are not individualized price or wage setting, as well as exemptions from the prohibition on price or wage setting. A person has not engaged in individualized price setting if the person can demonstrate, as described in the act, that differential prices are:Based on differences in the cost in providing a good or service to different consumers, such as delivery distance or temporal differences, such as ride or delivery time;Based on publicly disclosed eligibility criteria to all persons that meet the criteria, such as consumers purchasing in volume, or to all members of a broadly defined group of consumers, such as teachers;Afforded on equal terms to all participants in a loyalty, membership, or rewards program or are offered in response to a consumer complaint, service disruption, request for account cancellation, or similar reason;Offered pursuant to a specified needs-based discount program for reduced pricing related to income or financial need, such as hospital discounted care;Based on a subscription or other continuous agreement that includes a monthly or other recurring price that was not informed by a PWSA; orBased on a refusal to extend credit on specific terms or to enter into a financial transaction based on a consumer's data in a consumer report or data required as part of the application for the financial transaction.     A person has not engaged in individualized wage setting if the person can demonstrate, as described in the act, that the person offers individualized wages based solely on data specific to an individual worker that is directly related to worker seniority or the tasks the worker was required to perform, and the person discloses to the worker before hiring, and to all workers whose wages are set in whole or in part by a PWSA, what data is considered and how the PWSA considers the data.     A person that uses a PWSA shall develop and publish reasonable procedures to ensure the accuracy of all data considered by the PWSA, for workers to request and receive information about what data is collected, and to correct or challenge data considered by a PWSA.     A violation of the prohibition against individualized price or wage setting is a deceptive trade practice under the 'Colorado Consumer Protection Act' and is subject to the enforcement provisions and remedies provided in that act.(Note: This summary applies to this bill as enacted.)

Under current law, consumers in Colorado have a right to repair all digital electronic equipment, which could include equipment that is considered critical infrastructure.     The bill exempts information technology equipment that is intended for use to be used in critical infrastructure from Colorado's consumer right to repair laws. Critical infrastructure is defined as a system or asset, whether physical or virtual, so vital to the United States that the incapacity or destruction of the system or asset would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.      The bill authorizes the attorney general to review an exemption from Colorado's consumer right to repair laws for certain information technology equipment (equipment) that is intended to be used in critical infrastructure. In reviewing whether the equipment is exempt, the attorney general shall consider whether the equipment is actually intended to be used in a manner that qualifies as critical infrastructure and whether the equipment is sold under a business-to-business or business-to-government contract and not customarily sold in a retail setting. Any determination made by the attorney general regarding an exemption may be appealed by the manufacturer of the equipment.(Note: Italicized words indicate new material added to the original summary; dashes through words indicate deletions from the original summary.)(Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)

The act requires an operator of a social media platform (operator) to ensure that its social media platform provides a streamlined process to allow law enforcement agencies to contact the social media platform. The process must be available to law enforcement agencies at all times and make available a staffed hotline for the purposes of:Receiving and responding to questions about search warrants;Acknowledging the receipt of a search warrant within 8 hours after receipt; andProviding status updates on search warrant compliance to a requesting law enforcement agency.     With certain exceptions, an operator must comply with a search warrant within 24 hours if certain conditions apply. A court may reasonably extend this time if the court makes a written finding that the operator or social media platform has shown good cause for the extension and that an extension would not cause an adverse result. The act sets forth enforcement options for the attorney general and district attorneys regarding operators' compliance with search warrants.     The act requires an operator to report to a social media platform user's (user's) local law enforcement agency within 24 hours if the operator's social media platform takes any one of certain described adverse actions against a user. A violation of the reporting requirement is a violation of the 'Colorado Consumer Protection Act'.     In current law, 'social media platform' is defined as an internet-based service, website, or application that satisfies certain criteria, including having more than 100,000 active users in Colorado. The act removes this criterion.     The act makes conforming amendments as necessary to Senate Bill 26-011, as enacted in the 2026 regular legislative session, to have Senate Bill 26-011 conform with the provisions of the act.(Note: This summary applies to this bill as enacted.)

On and after January 1, 2027, when determining coverage for health-care services, the act requires entities that use an artificial intelligence system (AI system) for the purpose of conducting utilization review of health-care services, including health insurance companies (carriers), pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations, and managed care entities (entities), ensure that the AI system complies with certain requirements specified in the act. Specifically, an entity shall ensure that the AI system:Makes determinations based on medical or clinical history, the patient's individual clinical circumstances, and other relevant clinical factors specified in the act, with denial of coverage reviewed by a licensed clinician or physician or other competent regulated professional who is competent to evaluate the specific clinical issues and review the health benefit plan's terms of coverage (competent regulated professional);Does not base its determination solely on group data without reference to the individual's data;Is not used in any way that discriminates against individuals in violation of other state or federal laws and is fairly and equitably applied, including in accordance with regulations and guidance issued by the federal department of health and human services; andIs periodically reviewed to ensure the AI systems outcomes are accurate and reliable and that an individual's health data is not used beyond its intended or stated purpose.     Entities that use AI systems shall disclose to the division of insurance, the department of human services, or the department of health care policy and financing, as applicable, the utilization review functions for which the AI system will be used and the points in the utilization review process when it will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information to ensure that the use of the AI system complies with the requirements in the act.     The AI system may be used to assist in utilization review, including expedited approvals. A carrier's denial of coverage for a service based in whole or in part on medical necessity shall not be issued solely on the output of an AI system without human review by a licensed clinician or physician or other competent regulated professional.     Further, the act prohibits a carrier and a payer of services under the 'Colorado Medical Assistance Act' and the 'Children's Basic Health Plan Act' from paying for psychotherapy services that are provided directly to a client and that are conducted by an AI system.(Note: This summary applies to this bill as enacted.)

The act defines 3-dimensional printing to mean additive and subtractive manufacturing. The act prohibits knowingly manufacturing or producing a potentially functioning firearm, unfinished frame or receiver, large-capacity magazine, or rapid-fire device (firearm or firearm component) by 3-dimensional printing. The prohibition does not apply to a federally licensed firearm manufacturer, an instructor or student of an accredited gunsmithing program, or an institution that operates an accredited gunsmithing program. Unlawful 3-dimensional printing of a firearm or firearm component is a class 1 misdemeanor; except that a second or subsequent offense is a class 5 felony.     The prohibitions in the act only apply to potentially functional firearms and firearm components.(Note: This summary applies to this bill as enacted.)

The act requires a landlord to:Comply with applicable court rules governing the protection and redaction of personal identifying information in eviction filings; andRedact personal identifying information from supporting documents submitted to a court.     The act also requires a landlord to include in all rental applications:A notice to prospective tenants regarding the information and data the landlord will attempt to access when conducting a tenant screening;A general description of the factors the landlord will consider when evaluating a rental application, including a prospective tenant's credit history, rental history, income, and criminal background, if applicable; andAn indication of whether the landlord uses a third-party tenant screening service and, if so, the name of the service.(Note: This summary applies to this bill as enacted.)