HB 24-1130

House Bill 24-1130, which has been signed into law and will take effect on July 1, 2025, adds new protections for personal biometric data in Colorado. It requires companies that handle such data to create clear policies about how they store, protect, and eventually delete this information. The bill also mandates that these companies get explicit consent from individuals before collecting their biometric data, like fingerprints or facial recognition details, and outlines specific rules for employers when obtaining employee consent. This law will affect anyone whose biometric data is collected by businesses in Colorado.

Official Summary

The act amends the "Colorado Privacy Act" to add protections for individuals' biometric data by requiring a person that controls or processes one or more biometric identifiers (controller) to adopt a written policy that: Establishes a retention schedule for biometric identifiers and biometric data; Includes a protocol for responding to a data security incident that may compromise the security of biometric identifiers or biometric data; and Includes guidelines that require the deletion of a biometric identifier on or before certain dates. With certain exceptions, a controller must make its written policy available to the public. The act also: Prohibits a controller from collecting a biometric identifier unless the controller first satisfies certain disclosure and consent requirements; Specifies certain prohibited acts and requirements for controllers that process biometric identifiers and biometric data; Requires a controller to disclose to a consumer certain information concerning the collection and use of the consumer's biometric identifier; Restricts an employer's permissible reasons for obtaining an employee's consent for the collection of biometric identifiers; and Authorizes the attorney general to promulgate rules to implement the act. APPROVED by Governor May 31, 2024 EFFECTIVE July 1, 2025(Note: This summary applies to this bill as enacted.)

Votes