Skip to main content
Colorado General AssemblyToggle Main Menu
Agency NameToggle Agency Menu

Privacy of Biometric Identifiers & Data

Concerning protecting the privacy of an individual's biometric data.
2024 Regular Session
Civil Law
Public Health
Bill Summary

The act amends the "Colorado Privacy Act" to add protections for individuals' biometric data by requiring a person that controls or processes one or more biometric identifiers (controller) to adopt a written policy that:

  • Establishes a retention schedule for biometric identifiers and biometric data;
  • Includes a protocol for responding to a data security incident that may compromise the security of biometric identifiers or biometric data; and
  • Includes guidelines that require the deletion of a biometric identifier on or before certain dates.

With certain exceptions, a controller must make its written policy available to the public.

The act also:

  • Prohibits a controller from collecting a biometric identifier unless the controller first satisfies certain disclosure and consent requirements;
  • Specifies certain prohibited acts and requirements for controllers that process biometric identifiers and biometric data;
  • Requires a controller to disclose to a consumer certain information concerning the collection and use of the consumer's biometric identifier;
  • Restricts an employer's permissible reasons for obtaining an employee's consent for the collection of biometric identifiers; and
  • Authorizes the attorney general to promulgate rules to implement the act.

APPROVED by Governor May 31, 2024

EFFECTIVE July 1, 2025
(Note: This summary applies to this bill as enacted.)


Became Law


Bill Text

The effective date for bills enacted without a safety clause is August 7, 2024, if the General Assembly adjourns sine die on May 8, 2024, unless otherwise specified. Details