language: en · status: in-force · last checked: 2026-09-20

Colorado Privacy Act — C.R.S. §§ 6-1-1301 to 6-1-1314

Colorado's comprehensive consumer privacy statute, in force since 1 July 2023 and substantially extended by the 2024 session — the minors provisions (SB 24-041) from 1 October 2025 and the biometric provisions (HB 24-1130) from 1 July 2025. The Attorney General's rules under it are extracted in full at 4 CCR 904-3; read the two together, because the rules assume the statute's definitions and thresholds and do not restate them.

Applicability to EdTech

• The thresholds are the first question, and they are high. § 6-1-1304(1) reaches a controller that conducts business in Colorado or targets Colorado residents and either controls or processes the personal data of 100,000 consumers or more in a calendar year, or derives revenue (or a price discount) from selling personal data while processing the data of 25,000 or more. Biometrics are the exception: a controller of any amount of biometric identifiers is caught regardless.
• "Consumer" excludes the employment and commercial context (§ 6-1-1303(6)) — an individual acting in a commercial or employment capacity is not a consumer. A staff-facing product is reached through the biometric provisions, not the general ones.
• FERPA-regulated data is exempt (§ 6-1-1304(2)(j)(V)), and so is data maintained by a state institution of higher education, the state, the judicial department or a local authority ((2)(o)). A K-12 school deal will often sit inside FERPA and outside this Act; a consumer-facing or higher-education product frequently will not. Do the exemption analysis before the threshold analysis.
• "Child" and "minor" are different ages and do different work. A child is under 13 (§ 6-1-1303(4)) and inherits COPPA-style consent. A minor is anyone under 18, and that is the trigger for the 2025 duties below. A product for 14-to-17-year-olds is outside COPPA and squarely inside this Act.
• § 6-1-1308.5 — duty of care to minors. A controller offering an online service, product or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid any heightened risk of harm. Complying raises a rebuttable presumption of reasonable care in an enforcement action ((1)(b)) — which is why the rules' worked examples of "willfully disregards" are worth reading as build guidance.
• § 6-1-1309.5 — a minors-specific data protection assessment, required of anyone offering such a service to a known minor, addressing the purpose, the categories of a minor's personal data processed, and any reasonably foreseeable heightened risk of harm. Documentation must be kept for the longer of three years after processing ceases or the assessment's own period.
• Processors carry minors duties directly (§ 6-1-1305.5): a processor must assist the controller with §§ 6-1-1308.5 and 6-1-1309.5, take appropriate technical and organisational measures, and supply what the controller needs to document its assessments. This is contract-schedule material for an EdTech vendor, not just a controller-side concern.
• § 6-1-1314 — biometrics, with a written-policy mandate. Any controller processing biometric identifiers needs a published retention schedule, a data-incident protocol, and deletion guidelines keyed to the earliest of purpose satisfaction, 24 months after the consumer last interacted, or 45 days. There is an express anti-discrimination rule — no refusing service, and no different price or quality, because a consumer declined biometric consent — and an employee-consent regime of its own.
• Enforcement is public only (§ 6-1-1310 forecloses a private right of action). The Attorney General and district attorneys have exclusive authority (§ 6-1-1311) and a violation is a deceptive trade practice, which is what supplies the penalty scale from part 1 of article 1. Note that the cure period for the minors sections is discretionary — a notice of violation issues only "if a cure is deemed possible".

Contents

Currency

Read this before relying on the text. The source is the Colorado Revised Statutes 2024 edition, which is the newest the legislature has published at the path this builder can reach. Two consequences, both enforced or disclosed by the builder rather than assumed:

• The 2024 edition prints two versions of several provisions, because the 2024 session's amendments had future commencement dates when it went to press. The document reproduces the versions in force and removes the ten superseded ones, each identified by the publisher's own inline note; the Meta section lists every one removed.
• There is no gate on session laws. verify fails if a newer annual edition appears, or if the number of commencement notes changes — but nothing reachable from here would reveal a 2025 or 2026 amendment that no annual edition has yet picked up, because leg.colorado.gov returns 403 to every client including a browser.

Enforcement

Colorado Attorney General (Department of Law, Consumer Protection Section) and district attorneys, exclusively.

Licence

The corpus reproduces C.R.S. §§ 6-1-1301 to 6-1-1314 verbatim from the General Assembly's own compiled title 6 PDF (Colorado Revised Statutes 2024, Office of Legislative Legal Services), retrieved through the Internet Archive. It keeps the compilation's "Source" trails, "Editor's note" and "Cross references" blocks, and drops the "Law reviews" block.

Statute text enacted by a state legislature is outside copyright under the government edicts doctrine. In Georgia v. Public.Resource.Org, Inc., 590 U.S. 255 (2020) (slip opinion, read 2026-10-01), the Supreme Court held: "Under what has been dubbed the government edicts doctrine, officials empowered to speak with the force of law cannot be the authors of—and therefore cannot copyright—the works they create in the course of their official duties." It applied the doctrine to an arm of the legislature as well as to legislators: "Because Georgia’s annotations are authored by an arm of the legislature in the course of its legislative duties, the government edicts doctrine puts them outside the reach of copyright protection."

The PDF carries no copyright notice; every page is stamped "Colorado Revised Statutes 2024" and "Uncertified Printout". The official C.R.S. is published for the State by LexisNexis, but no LexisNexis text or annotation is reproduced here.

The curator should confirm one point: the Editor's notes and Cross references are taken to be prepared by the Office of Legislative Legal Services, the General Assembly's staff, which puts them in the position of Georgia's Code Revision Commission annotations. If any were authored by LexisNexis, they would need the same treatment as other publisher annotations and should be dropped.

Conditions: none attach to the statute text. The corpus nonetheless names the official source in its Sources section and in each fact document's {.meta} provenance lines, and its Meta section describes what it changed (anchors added, nothing reworded).

Related

• 4 CCR 904-3 — Colorado Privacy Act Rules — the operative detail layer, in full
• FERPA — the exemption that removes most K-12 school data from this Act
• COPPA — under-13; this Act's minors duties run to under-18

Sources

• C.R.S. 2024, title 6 — Consumer and Commercial Affairs (OLLS compilation; redirects to content.leg.colorado.gov)
• Colorado Attorney General — Colorado Privacy Act
• SB 21-190 as enacted — the original act, hosted by the AG