USA – COLORADO Trends and Developments Contributed by: Daniel Pietragallo and Douglas DePeppe, Buchalter LLP
Colorado is consistently at the forefront of technol - ogy and data governance regulation at the state level and is poised to maintain that position in 2026. Cur - rent legal trends include amendments to the Colorado Privacy Act regarding biometric data, online privacy for children, and the ongoing debate surrounding the implementation of SB24-205 (the Colorado AI Act). The Colorado AI Act was signed into law in 2024 and is the first comprehensive risk-based AI governance regulation in the United States. It seeks to prevent algorithmic discrimination by regulating high-risk AI systems. Although the law is subject to additional debate during the current legislative session, the structural framework will likely remain intact with enforcement starting during 2026. Updates to the Colorado Privacy Act The Colorado Privacy Act (CPA) was one of the first comprehensive state-level privacy laws in the United States and became effective on 1 July 2023. The CPA grants Colorado consumers the right to access, cor - rect, delete, and opt out of automated processing of their personal information for targeted advertising, sale, and certain forms of profiling. The CPA applies to controllers processing the personal information of 100,000 or more Colorado consumers annually or deriving revenue from the data of 25,000 or more Colorado consumers. The CPA imposes heightened obligations on the pro - cessing of sensitive data, which it defines to include racial or ethnic origin, religious beliefs, mental or physical health conditions, sexual orientation or gen - der identity, citizenship, or immigration status, genetic or biometric data, personal data from known chil - dren, and precise geolocation data. Controllers may not process sensitive data without first obtaining the consumer’s consent. Controllers must also conduct and document data protection assessments for processing activities that present heightened risk, including the processing of sensitive data, the sale of personal data, and pro - cessing for targeted advertising or certain forms of profiling. These data protection assessments must be provided to the Colorado Attorney General upon request and robust documentation serves as the best
defence against a regulatory inquiry. In the wake of a data breach, the absence of a well-documented assessment can be a significant liability, both in regu - latory proceedings and in civil litigation. Building on the foundation established in the Colorado Privacy Act, HB 24-1058 expanded the definition of “sensitive data” in the CPA to include biological data and neural data. The law defines “sensitive data” to include genetic, biometric, or biological data pro - cessed for the purpose of identifying any individual, or personal data from a known child. HB 24-1130 further amended the Colorado Privacy Act to add protection for the collection of biometric data, including establishing a retention schedule and protocols for responding to a data security incident. The law specifically prohibits the collection of biom - etric identifiers unless the controller obtains consent from the consumer and prohibits the sale, lease, or trade of any biometric data. Additionally, SB24-041 amends the Colorado Privacy Act to provide specific protection for children’s online privacy. The law limits the collection of precise geolo - cation data and requires online services to obtain con - sumer consent before processing a minor’s personal data for targeted advertising, sale, or profiling. From a compliance standpoint, the ongoing evolution of the Colorado Privacy Act will present challenges for companies who deal in the collection, processing, and transfer of sensitive data. Colorado continues to aggressively expand the scope of consumer rights in the CPA and create new compliance obligations for business. Any company doing business in one of the above-referenced sectors should consult with priva - cy experts to better understand their obligations and On 17 May 2024, Colorado Governor Jared Polis signed into law SB 24-205, which became the first comprehensive risk-based AI governance law in the United States. Although other states have passed AI governance and transparency laws, the Colorado AI Act creates many unique burdens for developers and deployers of high-risk AI systems, including documen - mitigate potential risk exposure. The Colorado AI Act (SB 24-205)
571 CHAMBERS.COM
Powered by FlippingBook