Technology (Consumer Data Protection)

In 2024, the general assembly enacted Senate Bill 24-205, which created consumer protections in interactions with artificial intelligence systems. The act repeals and reenacts those provisions with new requirements regarding the use of automated decision-making technology in consequential decisions.     The act defines an 'automated decision-making technology' (ADMT) as a technology that processes personal data and uses computation to generate output, including predictions, recommendations, classifications, rankings, scores, or other information that is used to make, guide, or assist a decision, judgment, or determination concerning an individual. The act defines a 'consequential decision' as a decision that relates to an individual's access to, eligibility for, or compensation related to education, employment, housing, financial or lending services, insurance, health-care services, or essential government services and public benefits.     The act requires the developer of an ADMT (developer) that is used to materially influence a consequential decision (covered ADMT), starting January 1, 2027, to provide a deployer of a covered ADMT (deployer) with technical documentation describing the covered ADMT's intended uses, categories of training data, known limitations, and instructions for appropriate use and human review. Developers must notify deployers of material updates or modifications to the covered ADMT. Both developers and deployers are required to retain records necessary to demonstrate compliance with the act for at least 3 years.     The act establishes consumer notice requirements, mandating that deployers provide clear and conspicuous notice to consumers at the point of interaction with a covered ADMT. A deployer is required to provide a consumer with a plain language description of a covered ADMT's role within 30 days after the covered ADMT makes a consequential decision that results in an adverse outcome for the consumer. The attorney general must adopt rules to clarify these post-adverse outcome disclosure requirements by January 1, 2027.     Consumers have the right to request personal data and correction of factually incorrect personal data used by a covered ADMT. The act also grants consumers the right to request meaningful human review and reconsideration following a covered ADMT making a consequential decision resulting in an adverse outcome.     The attorney general is directed to enforce the act through the 'Colorado Consumer Protection Act', and a violation of the act is deemed a deceptive trade practice. Before initiating an action before January 1, 2030, the attorney general must provide the developer or deployer with a 60-day notice and opportunity to cure the alleged violation, if a cure is deemed possible. The act does not create a new private right of action but establishes how fault is allocated between developers and deployers in civil actions alleging unlawful discrimination under existing law.     Specified entities are exempted from the requirements of the act to the extent the entities comply with other legal obligations.(Note: This summary applies to this bill as enacted.)

Current law requires that, before an individual is permitted to act as a transportation network company (TNC) driver through the use of a TNC's digital network, the individual shall obtain a criminal history record check. The act requires that the TNC:If the TNC has at least 20,000 rides occurring monthly (large-scale TNC) on its digital network, pay for the required criminal history record check for an individual before the individual is permitted to act as a driver;Procure a privately administered criminal history record check for a driver at least once every 6 months after the initial criminal history record check;Share the results of each criminal history record check with the driver who is the subject of the record check; andProcure a privately administered criminal history record check if a person files a complaint against a driver with the TNC or the public utilities commission (commission) regarding specified allegations. The TNC shall pay the costs of the privately administered criminal history record checks.     A TNC shall create a deactivation and suspension policy to initiate a review of a driver for deactivation within 7 business days if the TNC is notified through a complaint filed with the TNC or the commission or is contacted by the attorney general's office, a district attorney's office, or a law enforcement agency regarding certain allegations against the driver. A driver who has been deactivated may challenge the deactivation through the TNC's deactivation and suspension policy. The act requires the commission to create a process by rule for sharing information between TNCs regarding the deactivation of drivers. A TNC's deactivation and suspension policy must include meaningful human review of the permanent deactivation of a driver.     The act requires a TNC to provide regular safety training to each driver and rider in accordance with rules adopted by the commission.     If a person files a complaint against a TNC or a driver, the TNC shall respond to a subpoena or search warrant for information related to the complaint from a court, the attorney general's office, a district attorney's office, the commission, or a law enforcement agency no later than 72 hours after the request is made, unless the subpoenaing party agrees to a different deadline.     The act requires the commission to adopt rules on or before June 1, 2028, establishing requirements for a TNC to ensure that a driver or rider may opt in to audio and video recording of each prearranged ride and integrate audio and video recording into the TNC's digital platform. A large-scale TNC shall not charge a fee or increase the cost of a prearranged ride solely on the basis of a rider opting in to audio and video recording of the prearranged ride. The commission shall also adopt rules regarding access to, ownership of, storage of, notification about, and deadlines for the implementation of the audio and video recordings, including different requirements for large-scale and small-scale TNCs.     A provision in a contract between a TNC and a driver or rider is declared void as against public policy if the provision attempts or purports to waive specified rights.     The act requires that, on or before February 1, 2027, and on or before February 1 each year thereafter, a TNC shall submit specified data related to incidents involving safety and discrimination to the commission, the attorney general, and each member of the general assembly.     The act requires a TNC to develop policies to:Prevent imposter drivers, account sharing, and account renting;Prevent sexual assault, physical assault, and homicide against or committed by the TNC's drivers;Prohibit the transportation of an unaccompanied youth who is under 15 years old unless the youth is part of a duly authorized family account;Allow a driver to refuse a prearranged ride to an individual who is not authorized to use the account requesting the prearranged ride;Notify and train drivers and riders of any updates to TNC safety policies;Prohibit drivers from offering, selling, or providing food or beverages that are not factory-sealed to riders;Require drivers to report information regarding a conviction of or a plea of guilty or nolo contendere to specified offenses; andPrevent crimes committed against drivers by riders.     A TNC is prohibited from:Altering the rating a rider assigned to a driver or the rating a driver assigned to a rider on a TNC's digital platform;Assigning an automatic or default driver rating that the rider did not assign; orAssigning an automatic or default rider rating that the driver did not assign.     A TNC may delete ratings or reviews that are plausibly motivated by fraud or bias. A TNC shall not consider negative ratings or reviews that are motivated by fraud or bias in a review of a driver for deactivation or an internal deactivation reconsideration.     A TNC is prohibited from collecting biometric data or biometric identifiers from a driver or rider without first obtaining the consent of the driver or rider. If a TNC collects biometric data or biometric identifiers from a driver or rider, the TNC shall comply with specified provisions of the 'Colorado Privacy Act' regarding biometric data and biometric identifiers.     A TNC that violates the act may be assessed a civil penalty of not more than $1,500 per violation.(Note: This summary applies to this bill as enacted.)

The bill provides personal data privacy protections for consumers relating to homeowner's insurance transactions.     The bill establishes standards for an insurer, insurance producer, or surplus line insurer (licensee), and the director, officer, or agent of the licensee, as well as a processor on behalf of a licensee, relating to the use of a consumer's personal data. A licensee or processor is prohibited from processing a consumer's personal data for purposes unrelated to a homeowner's insurance transaction, selling personal data, or engaging in targeted advertising or joint marketing of cobranded financial products without first obtaining the consumer's affirmative consent to any of those practices by exercising the right to opt in to those practices. Affiliates of licensees are subject to the same requirements as licensees with respect to processing personal data.     A consumer's personal data is defined in the bill, in part, as data that identifies, relates to, describes, or is capable of being associated with a particular consumer or household and includes, among other data, a consumer's name, unique personal identifier, account number, social security number, property records, products or services purchased, account logins, information regarding the consumer's interactions with an internet application, loss history information, credit report, insurance score, insurance policy number and expiration date, and racial and ethnic origin. Personal data does not include de-identified data and publicly available data.     A consumer has the right to confirm whether a licensee is processing the consumer's personal data, to access the consumer's personal data, and to request a correction or amendment of inaccurate or incomplete personal data or the deletion of personal data that is not needed for the homeowner's insurance transaction or for specific products or services for which the consumer has given their consent.     The bill requires a licensee to provide a consumer with a data privacy notice that includes the consumer's rights with respect to personal data, including the right to know whether and with whom personal data is being shared, the type and sources of personal data being collected, and the right to opt in to the sharing or sale of personal data. The bill prohibits a licensee from retaliating against a consumer with respect to the provision of homeowner's insurance and the terms of the insurance if the consumer does not consent to opt in to certain actions relating to their personal data.     The bill requires a licensee to:Enter into a contract with a processor to ensure that those processing personal data on behalf of the licensee are complying with the consumer data privacy protections; andHave a retention policy to ensure that a consumer's personal data is deleted when it is no longer necessary for the insurance or other products or services to which the consumer has consented.     Additionally, if a licensee makes an adverse underwriting decision relating to a consumer's request for homeowner's insurance, the licensee must provide the consumer with the specific reasons for the adverse decision and allow the consumer to review the specific data relating to the adverse decision and to correct the data if appropriate. The bill prohibits a licensee from denying insurance based solely on the loss history of the previous owner of the property, or based solely on personal data received from a processor whose primary source of information is licensees, without the licensee obtaining further information that supports the adverse decision.     A consumer aggrieved by a violation of the consumer data privacy protections in the bill may bring a civil action in court and may be awarded damages for each violation, including treble damages if proved by clear and convincing evidence that the person violating the bill engaged in bad faith conduct or intentionally violated the consumer data privacy protection provisions of the bill.     In addition, the bill makes a violation of the bill an unfair or deceptive act or practice in the business of insurance and gives the commissioner of insurance the power to enforce the bill through actions against licensees and the assessment of civil penalties.(Note: This summary applies to this bill as introduced.)

Surveillance data is defined in the act as data that is obtained through observation, inference, or surveillance of consumers or workers and that is related to personal characteristics, online behaviors, or biometrics of an individual or group, band, class, or tier to which the individual belongs. The definition of 'worker' in the act excludes federal and state employees and employees of public entities.     The act prohibits discrimination against a consumer or worker resulting from the use of a price or wage setting algorithm (PWSA) that uses statistical modeling, data analytics, artificial intelligence, or other data processing techniques to analyze surveillance data, the output of which is a substantial factor in:Individualized price setting used to determine the amount charged to a consumer; orIndividualized wage setting used to determine the wage offered to a worker.     The act specifies activities that are not individualized price or wage setting, as well as exemptions from the prohibition on price or wage setting. A person has not engaged in individualized price setting if the person can demonstrate, as described in the act, that differential prices are:Based on differences in the cost in providing a good or service to different consumers, such as delivery distance or temporal differences, such as ride or delivery time;Based on publicly disclosed eligibility criteria to all persons that meet the criteria, such as consumers purchasing in volume, or to all members of a broadly defined group of consumers, such as teachers;Afforded on equal terms to all participants in a loyalty, membership, or rewards program or are offered in response to a consumer complaint, service disruption, request for account cancellation, or similar reason;Offered pursuant to a specified needs-based discount program for reduced pricing related to income or financial need, such as hospital discounted care;Based on a subscription or other continuous agreement that includes a monthly or other recurring price that was not informed by a PWSA; orBased on a refusal to extend credit on specific terms or to enter into a financial transaction based on a consumer's data in a consumer report or data required as part of the application for the financial transaction.     A person has not engaged in individualized wage setting if the person can demonstrate, as described in the act, that the person offers individualized wages based solely on data specific to an individual worker that is directly related to worker seniority or the tasks the worker was required to perform, and the person discloses to the worker before hiring, and to all workers whose wages are set in whole or in part by a PWSA, what data is considered and how the PWSA considers the data.     A person that uses a PWSA shall develop and publish reasonable procedures to ensure the accuracy of all data considered by the PWSA, for workers to request and receive information about what data is collected, and to correct or challenge data considered by a PWSA.     A violation of the prohibition against individualized price or wage setting is a deceptive trade practice under the 'Colorado Consumer Protection Act' and is subject to the enforcement provisions and remedies provided in that act.(Note: This summary applies to this bill as enacted.)

The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves.Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety.The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.(Note: This summary applies to this bill as introduced.)

The bill criminalizes the use of an individual's fingerprint, voiceprint, retina, iris, or facial map (personally identifying feature) in an advertisement, deepfake, image, video, voice recording, or other digital depiction, without the individual's permission (unlawful use of a personally identifying feature). Unlawful use of a personally identifying feature is a class 5 felony, and unlawful use of a personally identifying feature with the intent to harm the individual or another individual is a class 4 felony.An individual harmed by an unlawful use of a personally identifying feature may bring a civil cause of action and collect damages and reasonable attorney fees.(Note: This summary applies to this bill as introduced.)