Concerning Protecting the Privacy of an Individual's Biometric Data (HB 24-1130)
Colorado Biometric Identifier Privacy Amendment
Data last verified: March 23, 2026
- Effective Date
- July 1, 2025
- Enforcement Date
- Not specified in statute
Summary
Colorado HB 24-1130 amends the Colorado Privacy Act (Part 13) to add biometric identifier protections. Adds § 6-1-1314 requiring consent before collection, mandating a publicly available written retention/destruction/breach-response policy, prohibiting sale/lease/trade of biometric identifiers, extending protections to employees, and granting consumers a right to access their biometric data. Applies to any controller processing biometric identifiers regardless of volume threshold. Enforced by AG and district attorneys under CPA § 6-1-112(1)(a).
Who It Applies To
Not specified in statute
Penalties
- Penalty Range
- $0 – $20,000per violation
- Cure Period
- Not specified in statute
- Private Right of Action
- No private right of action
- Enforcement Body
- Colorado Attorney General and district attorneys
- Notes
- § 6-1-1314 adds biometric provisions to Part 13 of CPA. Part 13 violations are deceptive trade practices per § 6-1-1311(1)(c) → § 6-1-105(1)(nnn) → CPA § 6-1-112(1)(a). AG and DA exclusive enforcement per § 6-1-1311(1)(a)-(b). No private right of action per § 6-1-1310(1).
Requirements (5)
- Consent§ 6-1-1314(4)(a)-(e)
This law requires controllers to inform consumers and obtain consent per § 6-1-1308(7) before collecting biometric identifiers.
- Disclosure§ 6-1-1314(2)(a)
This law requires controllers to adopt and publish a written policy with retention schedule, data breach protocol, and biometric identifier deletion guidelines.
- Consent§ 6-1-1314(6)(a)-(d)
This law regulates employer collection of employee biometric identifiers, with permitted uses limited to access control, timekeeping, workplace safety, and emergency response.
- Consent§ 6-1-1314(4)(b)-(c)
This law prohibits the sale, lease, or trade of biometric identifiers and restricts disclosure to specific exceptions.
- Disclosure§ 6-1-1314(5)(a)-(b)
This law grants consumers the right to access their biometric data, including source, purpose, and third-party disclosures.
Claire tracks 31 state and local AI laws across 23 US states. No prescriptive federal AI compliance statutes have been enacted. EU AI Act and sector-specific regulations are not covered.
Check if this law applies to your business