The bill provides personal data privacy protections for consumers relating to homeowner's insurance transactions. The bill establishes standards for an insurer, insurance producer, or surplus line insurer (licensee), and the director, officer, or agent of the licensee, as well as a processor on behalf of a licensee, relating to the use of a consumer's personal data. A licensee or processor is prohibited from processing a consumer's personal data for purposes unrelated to a homeowner's insurance transaction, selling personal data, or engaging in targeted advertising or joint marketing of cobranded financial products without first obtaining the consumer's affirmative consent to any of those practices by exercising the right to opt in to those practices. Affiliates of licensees are subject to the same requirements as licensees with respect to processing personal data. A consumer's personal data is defined in the bill, in part, as data that identifies, relates to, describes, or is capable of being associated with a particular consumer or household and includes, among other data, a consumer's name, unique personal identifier, account number, social security number, property records, products or services purchased, account logins, information regarding the consumer's interactions with an internet application, loss history information, credit report, insurance score, insurance policy number and expiration date, and racial and ethnic origin. Personal data does not include de-identified data and publicly available data. A consumer has the right to confirm whether a licensee is processing the consumer's personal data, to access the consumer's personal data, and to request a correction or amendment of inaccurate or incomplete personal data or the deletion of personal data that is not needed for the homeowner's insurance transaction or for specific products or services for which the consumer has given their consent. The bill requires a licensee to provide a consumer with a data privacy notice that includes the consumer's rights with respect to personal data, including the right to know whether and with whom personal data is being shared, the type and sources of personal data being collected, and the right to opt in to the sharing or sale of personal data. The bill prohibits a licensee from retaliating against a consumer with respect to the provision of homeowner's insurance and the terms of the insurance if the consumer does not consent to opt in to certain actions relating to their personal data. The bill requires a licensee to:Enter into a contract with a processor to ensure that those processing personal data on behalf of the licensee are complying with the consumer data privacy protections; andHave a retention policy to ensure that a consumer's personal data is deleted when it is no longer necessary for the insurance or other products or services to which the consumer has consented. Additionally, if a licensee makes an adverse underwriting decision relating to a consumer's request for homeowner's insurance, the licensee must provide the consumer with the specific reasons for the adverse decision and allow the consumer to review the specific data relating to the adverse decision and to correct the data if appropriate. The bill prohibits a licensee from denying insurance based solely on the loss history of the previous owner of the property, or based solely on personal data received from a processor whose primary source of information is licensees, without the licensee obtaining further information that supports the adverse decision. A consumer aggrieved by a violation of the consumer data privacy protections in the bill may bring a civil action in court and may be awarded damages for each violation, including treble damages if proved by clear and convincing evidence that the person violating the bill engaged in bad faith conduct or intentionally violated the consumer data privacy protection provisions of the bill. In addition, the bill makes a violation of the bill an unfair or deceptive act or practice in the business of insurance and gives the commissioner of insurance the power to enforce the bill through actions against licensees and the assessment of civil penalties.(Note: This summary applies to this bill as introduced.)
The act defines a 'conversational artificial intelligence service' as an artificial intelligence system that is accessible to the general public and that primarily simulates human conversation and interaction through adaptive textual, visual, or aural communications. Effective January 1, 2027, the act creates requirements and prohibitions for a person, partnership, corporation, or entity that develops and makes publicly available a conversational artificial intelligence service or offers a conversational artificial intelligence service to a consumer (operator). An operator is required to use commercially reasonable methods or generally accepted methods to estimate the age of a consumer who has or opens an account or profile to use a conversational artificial intelligence service (account holder) and the age of other users of a conversational artificial intelligence service. If an operator knows that an account holder or user is a minor, an operator is:Required to provide certain disclosures;Prohibited from providing the minor account holder or minor user with points or rewards to encourage engagement with the conversational artificial intelligence service;Required to institute technically feasible measures to prevent the conversational artificial intelligence service from producing explicit sexual conduct, intimate digital depictions, or statements that simulate emotional dependence;Required to implement a protocol for a conversational artificial intelligence service to stop engaging in response to a user prompt regarding sexual conduct with a minor; andRequired to provide tools for the minor account holder or minor user or a parent or guardian of the minor account holder or minor user to manage the minor account holder's or minor user's privacy and account settings. The act also requires an operator to provide a disclosure to a user that a conversational artificial intelligence service is artificial intelligence, implement a protocol for user prompts regarding suicidal ideation or self-harm, and annually report to the attorney general's office information regarding the protocol the operator is implementing. The act prohibits an operator from stating that any output data provided by a conversational artificial intelligence service is provided by, endorsed by, or equivalent to services provided by certain licensed or certified professionals. The act clarifies that nothing in the act limits an individual's ability to access certain information and resources pursuant to the state constitution, requires an operator to disclose confidential information, or authorizes content moderation practices inconsistent with the United States constitution.(Note: This summary applies to this bill as enacted.)
Surveillance data is defined in the act as data that is obtained through observation, inference, or surveillance of consumers or workers and that is related to personal characteristics, online behaviors, or biometrics of an individual or group, band, class, or tier to which the individual belongs. The definition of 'worker' in the act excludes federal and state employees and employees of public entities. The act prohibits discrimination against a consumer or worker resulting from the use of a price or wage setting algorithm (PWSA) that uses statistical modeling, data analytics, artificial intelligence, or other data processing techniques to analyze surveillance data, the output of which is a substantial factor in:Individualized price setting used to determine the amount charged to a consumer; orIndividualized wage setting used to determine the wage offered to a worker. The act specifies activities that are not individualized price or wage setting, as well as exemptions from the prohibition on price or wage setting. A person has not engaged in individualized price setting if the person can demonstrate, as described in the act, that differential prices are:Based on differences in the cost in providing a good or service to different consumers, such as delivery distance or temporal differences, such as ride or delivery time;Based on publicly disclosed eligibility criteria to all persons that meet the criteria, such as consumers purchasing in volume, or to all members of a broadly defined group of consumers, such as teachers;Afforded on equal terms to all participants in a loyalty, membership, or rewards program or are offered in response to a consumer complaint, service disruption, request for account cancellation, or similar reason;Offered pursuant to a specified needs-based discount program for reduced pricing related to income or financial need, such as hospital discounted care;Based on a subscription or other continuous agreement that includes a monthly or other recurring price that was not informed by a PWSA; orBased on a refusal to extend credit on specific terms or to enter into a financial transaction based on a consumer's data in a consumer report or data required as part of the application for the financial transaction. A person has not engaged in individualized wage setting if the person can demonstrate, as described in the act, that the person offers individualized wages based solely on data specific to an individual worker that is directly related to worker seniority or the tasks the worker was required to perform, and the person discloses to the worker before hiring, and to all workers whose wages are set in whole or in part by a PWSA, what data is considered and how the PWSA considers the data. A person that uses a PWSA shall develop and publish reasonable procedures to ensure the accuracy of all data considered by the PWSA, for workers to request and receive information about what data is collected, and to correct or challenge data considered by a PWSA. A violation of the prohibition against individualized price or wage setting is a deceptive trade practice under the 'Colorado Consumer Protection Act' and is subject to the enforcement provisions and remedies provided in that act.(Note: This summary applies to this bill as enacted.)
Under current law, consumers in Colorado have a right to repair all digital electronic equipment, which could include equipment that is considered critical infrastructure. The bill exempts information technology equipment that is intended for use to be used in critical infrastructure from Colorado's consumer right to repair laws. Critical infrastructure is defined as a system or asset, whether physical or virtual, so vital to the United States that the incapacity or destruction of the system or asset would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters. The bill authorizes the attorney general to review an exemption from Colorado's consumer right to repair laws for certain information technology equipment (equipment) that is intended to be used in critical infrastructure. In reviewing whether the equipment is exempt, the attorney general shall consider whether the equipment is actually intended to be used in a manner that qualifies as critical infrastructure and whether the equipment is sold under a business-to-business or business-to-government contract and not customarily sold in a retail setting. Any determination made by the attorney general regarding an exemption may be appealed by the manufacturer of the equipment.(Note: Italicized words indicate new material added to the original summary; dashes through words indicate deletions from the original summary.)(Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)
On and after January 1, 2027, when determining coverage for health-care services, the act requires entities that use an artificial intelligence system (AI system) for the purpose of conducting utilization review of health-care services, including health insurance companies (carriers), pharmacy benefit managers, private utilization review organizations, behavioral health administrative services organizations, and managed care entities (entities), ensure that the AI system complies with certain requirements specified in the act. Specifically, an entity shall ensure that the AI system:Makes determinations based on medical or clinical history, the patient's individual clinical circumstances, and other relevant clinical factors specified in the act, with denial of coverage reviewed by a licensed clinician or physician or other competent regulated professional who is competent to evaluate the specific clinical issues and review the health benefit plan's terms of coverage (competent regulated professional);Does not base its determination solely on group data without reference to the individual's data;Is not used in any way that discriminates against individuals in violation of other state or federal laws and is fairly and equitably applied, including in accordance with regulations and guidance issued by the federal department of health and human services; andIs periodically reviewed to ensure the AI systems outcomes are accurate and reliable and that an individual's health data is not used beyond its intended or stated purpose. Entities that use AI systems shall disclose to the division of insurance, the department of human services, or the department of health care policy and financing, as applicable, the utilization review functions for which the AI system will be used and the points in the utilization review process when it will be used, the process for human oversight of adverse coverage determinations, and the process for maintaining audit information to ensure that the use of the AI system complies with the requirements in the act. The AI system may be used to assist in utilization review, including expedited approvals. A carrier's denial of coverage for a service based in whole or in part on medical necessity shall not be issued solely on the output of an AI system without human review by a licensed clinician or physician or other competent regulated professional. Further, the act prohibits a carrier and a payer of services under the 'Colorado Medical Assistance Act' and the 'Children's Basic Health Plan Act' from paying for psychotherapy services that are provided directly to a client and that are conducted by an AI system.(Note: This summary applies to this bill as enacted.)
The act requires a landlord to:Comply with applicable court rules governing the protection and redaction of personal identifying information in eviction filings; andRedact personal identifying information from supporting documents submitted to a court. The act also requires a landlord to include in all rental applications:A notice to prospective tenants regarding the information and data the landlord will attempt to access when conducting a tenant screening;A general description of the factors the landlord will consider when evaluating a rental application, including a prospective tenant's credit history, rental history, income, and criminal background, if applicable; andAn indication of whether the landlord uses a third-party tenant screening service and, if so, the name of the service.(Note: This summary applies to this bill as enacted.)
Existing law requires a county or municipality to publish legal notices in a physical print newspaper. The act requires a newspaper to also publish these notices online, either on its own website or by providing a link on its website to a location where the full text of the notice is available, such as the statewide public notice website. Legal notices published online must be free to access and cannot be kept behind a paywall or subscription. The act also requires the statewide public notice website to include a list of newspapers that meet the requirements to publish legal notices.(Note: This summary applies to this bill as enacted.)
Tags
Local Government
The bill authorizes the public utilities commission (commission) to regulate broadband service and voice-over-internet protocol (VoIP) service in the state. The commission may adopt rules related to the quality, safety, and resiliency of broadband services in Colorado.The commission is authorized to conduct evaluations of broadband service facilities and infrastructure and to issue orders that require an internet service provider to take remedial actions to correct unsafe or inadequate service. The commission is required to submit to the general assembly an annual report regarding the quality, safety, and resiliency of broadband and VoIP services.(Note: This summary applies to this bill as introduced.)
Under the bill, a "covered business" is defined as a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate of such a legal entity, that:Conducts business in the state and generates a majority of its annual revenue from online services;Makes available online gaming services, products, or features that are reasonably likely to be accessed by a user who is a minor or who the covered business labels as a minor (covered minor);Collects users' personal data or has users' personal data collected on its behalf by a processor; andSolely or jointly with others determines the purposes and means of the processing of users' personal data. The bill states that a covered business that processes the personal data of a covered minor owes a minimum duty of care to the covered minor. The bill also requires a covered business to:Configure default privacy settings provided to a covered minor to the highest level of privacy and to include certain default settings;Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted and, if the business receives such a request, to honor it within 15 days; andImmediately delete all data that relates to the determination of a user's age after it is determined that the user is a covered minor. The bill prohibits a covered business from:Providing a covered minor with a single setting that makes all of the default privacy settings less protective at once;Requesting or prompting a covered minor to make their privacy settings less protective;Collecting, selling, sharing, or retaining personal data of a covered minor that is not necessary to provide an online gaming service, product, or feature with which the covered minor is actively and knowingly engaged;Using previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected;Permitting an individual to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked;Using the personal data of a covered minor to select, recommend, or prioritize media for the covered minor unless the covered minor makes certain requests or takes certain actions warranting such conduct by the covered business; orSending push notifications to a covered minor between 12 midnight and 6 a.m. The bill imposes additional specific requirements and prohibitions for a covered business that collects users' personal data for the purpose of conducting age assurance. The bill requires a covered business to ensure that the purchase price for an online gaming service, product, or feature that is made available through the covered business's online gaming service, product, or feature and that is reasonably likely to be accessed by a covered minor is listed in United States dollars at the point of sale. A covered business shall impose and collect a fee on each add-on transaction that is conducted by a covered minor through the covered business's online gaming service, product, or feature. The amount of the fee is 5% of the amount of the transaction. Money collected as such fees is credited to the state public school fund. The bill requires a social media platform to provide certain information on its website or mobile application concerning privacy policies and the use of algorithms. A social media platform is prohibited from using an algorithmic recommendation system to sell or otherwise distribute an illicit substance to a covered minor.(Note: This summary applies to this bill as introduced.)
Under current law, a political party must ensure that any person, upon request, is able to participate in a precinct caucus or a party assembly with the use of a video conferencing platform or alternative means of participation. The failure of any political party to make a reasonable effort to comply with these accessibility requirements constitutes discrimination on the basis of disability in a place of public accommodation. The act clarifies that only a person who is otherwise eligible pursuant to statute to participate in a precinct caucus or a party assembly may request video conferencing or another alternative means of participation. The act also clarifies that a person who is subjected to a violation of a political party's duties regarding these accessibility requirements may file suit only against the central committee of the political party holding the caucus or assembly. An individual, including a member of the central committee of the political party or a volunteer for a political party, may not be held liable for a violation of these accessibility requirements. Upon a finding of a violation of these accessibility requirements, a court may require compliance with the applicable accessibility requirement and either actual monetary damages or a statutory fine of $3,500 for each violation.(Note: This summary applies to this bill as enacted.)
