Technology

The bill creates the "Unmanned Aircraft Systems Rights and Authorities Act". The bill does the following:Authorizes an individual to operate an unmanned aircraft system (drone system) for recreational purposes in this state;Authorizes a person to operate a drone system for commercial purposes within this state if the business is lawful and the operation is in compliance with state and federal law;Prohibits the state or a political subdivision of the state (local government) from requiring the registration of an unmanned aircraft or a drone system beyond what may be required by state and federal law;Clarifies that the operation of a drone system in compliance with federal law does not, standing alone, give rise to legal liability;Establishes and limits the regulatory authority of the state; andEstablishes and limits the regulatory authority of a local government.In connection with establishing and limiting the regulatory authority of the state, the bill authorizes the state to regulate the use of drone systems owned by or used by the state or launching from or landing on state property. Exceptions to the state's regulatory authority are made for emergencies, maintenance, technical malfunctions, and law enforcement.In connection with establishing and limiting the regulatory authority of local governments, the bill prohibits a local government from regulating ownership, operation, design, manufacture, testing, maintenance, licensing, registration, certification, or equipment requirements or qualifications, training, or certification of a pilot, operator, or observer. A local government may regulate the use of drone systems owned by or used by the local government or launching from or landing on local government property. A local government's resolution or ordinance that is general in nature, such as a nuisance regulation, applies to a drone system.(Note: This summary applies to this bill as introduced.)

The bill establishes the "Surveillance Accountability and Freedom Ensured (SAFE) Act" (SAFE Act). On and after July 1, 2027, the SAFE Act requires a law enforcement agency to use surveillance technology only for lawful purposes directly related to public safety or for an active investigation.If a law enforcement agency uses surveillance technology to collect surveillance data, the law enforcement agency must comply with certain requirements related to the collection, storage, sharing, and destruction of the data.The law enforcement agency must ensure that:Facial recognition systems are only used after a warrant is obtained or in exigent circumstances when there is an imminent threat to public safety;Traffic cameras and automated license plate readers must only be used in public spaces and for specific enforcement purposes, such as traffic violations or identifying stolen vehicles; andDrone cameras are operated in compliance with federal aviation administration regulations.A law enforcement agency may store data collected by surveillance technology only for a specified amount of time depending on the type of technology used and how the data is collected or until an active investigation is concluded.A law enforcement agency shall not sell any data that is collected from its surveillance technologies, but the law enforcement agency may share the surveillance data with another law enforcement agency if the data is related to an active investigation and the other law enforcement agency agrees to comply with the requirements of the SAFE Act. A law enforcement agency must also ensure that surveillance data is permanently destroyed at the end of an applicable retention period or once the data is no longer needed for the matter. The bill creates civil penalties for violations of these provisions.The bill also requires a law enforcement agency to make certain information related to the law enforcement agency's compliance with the SAFE Act available to residents who request it at no cost to the resident.The bill requires the attorney general to conduct an audit of a law enforcement agency every 2 years and authorizes the attorney general to bring a civil action to enforce the SAFE Act.(Note: This summary applies to this bill as introduced.)

Beginning July 1, 2026, if a petitioner is under 18 years old at the time of filing a petition seeking to change the petitioner's name, the act requires the court to suppress the record unless the petitioner was previously convicted of a felony. The act authorizes the court to use the suppressed court record for administrative purposes, but the court is prohibited from publishing the petitioner's name or the petitioner's new name online. A petitioner who is under 18 years old is not required to give public notice of the name change. The act authorizes an individual to access a suppressed court record without a court order if the individual obtains verbal consent from a party to the case and submits an affidavit to the court, upon penalty of perjury, that the individual has obtained the verbal consent.(Note: This summary applies to this bill as enacted.)

The act creates new requirements and civil remedies beginning June 1, 2027, related to individuals under 18 years old (minors) who are featured in compensated content on online hosting platforms (online content).     A minor is considered to be engaged in content creation work if, over a 12-month period, the following 3 criteria are met:At least 30% of a content creator's online content produced within a 30-day period includes the minor's likeness, name, or photograph;The number of views of the online content meets the online hosting platform's compensation threshold or the content creator receives $0.10 or more per view, including compensation from sponsorships; andThe content creator receives at least $40,000 in actual compensation from the online content.     Content creators whose online content features a minor engaged in content creation work must maintain specific records, including:Proof of the minor's age;The total compensation generated; andThe total number of minutes the minor was featured in posts featuring online content.     A content creator shall compensate a minor engaged in content creation work by setting aside a portion of the gross earnings into a trust account for the minor until the minor reaches the age of majority or is declared emancipated. A court may distribute money from the trust account to the minor before the minor reaches the age of majority or is declared emancipated upon petition from the trustee and a finding that the money will only be used for specific expenses that solely benefit the minor.     An adult or an emancipated minor who was featured as a uniquely identifiable minor in a content creator's post featuring online content on or after June 1, 2027, may request that the content creator delete the post or remove the uniquely identifiable information. The content creator must comply with the request within 72 hours. If the content creator fails to comply after 30 days, the individual may sue for various types of relief, and the online hosting platform must review and take reasonable steps to remove the content unless certain exceptions apply.     The act prohibits a person from financially benefiting from knowingly producing or distributing online content of a minor with the intent to sexually gratify or elicit a sexual response in the viewer. Exceptions apply for law enforcement, reporting unlawful activity, legal proceedings, and certain actions engaged in by online hosting platforms. Online hosting platforms are required to develop and implement a risk-based strategy to help mitigate risks related to the monetization of the intentional sexualization of known minors.     A civil action may be filed on behalf of a minor for damages, including actual damages, punitive damages, and attorney fees, if a content creator fails to comply with specified provisions of the act.(Note: This summary applies to this bill as enacted.)

The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves.Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety.The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.(Note: This summary applies to this bill as introduced.)

The bill prohibits a government entity from accessing a database that reveals an individual's or a vehicle's historical location information, subject to certain exceptions. The bill prohibits a government entity from sharing historical location information with third parties or government agencies outside their jurisdiction, subject to certain exceptions, and makes historical location information not a public record for the purposes of the "Colorado Open Records Act".The bill requires a government entity that collects historical location information to adopt a policy to maintain compliance with the provisions of the regulatory scheme.An enforcement action is created for the attorney general to enforce the provisions of the bill. Historical location information obtained in violation of the prohibitions of the bill are inadmissible in trial.(Note: This summary applies to this bill as introduced.)

The act requires an operating system provider that operates a publicly available internet website, software application, online service, or platform that distributes and facilitates, on a commercial basis, the download of applications from third-party developers to users of devices (covered application store) or makes a covered application store available preinstalled on an operating system to:Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or age bracket of the user of that device in order to provide a signal regarding the user's age (age signal) to applications available in the covered application store;Provide application developers with a reasonably consistent, real-time application programming interface to request and receive an age signal; andSend only the minimum amount of information necessary to comply with the act. An operating system provider or covered application store shall not share an age signal with a third party for a purpose not required by the act.     The act requires a consumer software application that is accessed through a covered application store and that may be run or directed by a user on a device (covered application) to request an age signal with respect to a particular user when the covered application is initially launched or when a user first creates an account. A covered application that receives an age signal is deemed to have knowledge of the age range of the user to whom that age signal pertains across all platforms of the application and points of access of the application. However, if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range.     A developer shall ensure that a covered application that receives an age signal does not:Request more information concerning a user from an operating system provider or a covered application store than is necessary to comply with the act; orCommunicate an age signal to a third party for a purpose not required by the act.     With respect to a device for which account setup was completed before July 1, 2028, the act requires an operating system provider to provide, before January 1, 2029, an accessible interface that allows an account holder to indicate the birth date or age of the user of that device for the purpose of providing an age signal regarding the user's age-bracket data to covered applications available in the operating system provider's covered application store. If a covered application last updated on or after July 1, 2027, was downloaded to a device before July 1, 2028, and the covered application has not requested an age signal with respect to the user of the device on which the covered application was downloaded, the covered application must request an age signal from the covered application store from which the covered application was downloaded with respect to that user before January 1, 2029.     A person that violates the act must pay a civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation. The penalty is assessed and recovered in a civil action brought by the attorney general. An operating system provider or covered application store that makes a good faith effort to comply with the act is not liable for an erroneous age signal or for conduct by a covered application that receives an age signal.(Note: This summary applies to this bill as enacted.)

The bill criminalizes the use of an individual's fingerprint, voiceprint, retina, iris, or facial map (personally identifying feature) in an advertisement, deepfake, image, video, voice recording, or other digital depiction, without the individual's permission (unlawful use of a personally identifying feature). Unlawful use of a personally identifying feature is a class 5 felony, and unlawful use of a personally identifying feature with the intent to harm the individual or another individual is a class 4 felony.An individual harmed by an unlawful use of a personally identifying feature may bring a civil cause of action and collect damages and reasonable attorney fees.(Note: This summary applies to this bill as introduced.)