SB 25-201

Senate Bill 25-201 requires websites that publish or distribute material harmful to children to implement age verification measures starting July 1, 2026. These sites must ensure users are not children and provide ways for users to verify their age without revealing personal identity information. The bill also mandates annual independent audits of these platforms' age verification processes and ensures that platforms do not rely solely on IP addresses to determine a user's location. Since the status is "signed," this means the bill has been approved by both legislative bodies and signed into law by the governor, making it enforceable starting in 2026.

Official Summary

On and after July 1, 2026, the bill requires certain internet websites that knowingly and intentionally publish or distribute material that is harmful to children (covered platforms) to: Perform one or more reasonable age verification measures to verify the age of each individual who attempts to access such material; Prevent children from accessing such material; and Arrange for annual independent audits of the results of the covered platform's reasonable age verification measures. On and after July 1, 2026, a covered platform must offer each user at least one option by which the covered platform may verify the user's age without the user having to disclose the user's identity. For this purpose, a covered platform must employ commercially available technologies that are independently certified to be highly effective in establishing that an individual is not a child. A covered platform may not rely solely upon the geographical registration of an internet protocol address to determine a user's location and must apply extensive due diligence based on available technology before concluding that an individual is not located in Colorado. A covered platform must ensure that each reasonable age verification measure that the covered platform employs includes a means by which a potential user of the covered platform may appeal a determination concerning the potential user's age. A covered platform that acquires personal data for the purposes of age verification must destroy the personal data as soon as reasonably possible after a potential user's age is checked for age verification. In acquiring and retaining personal data, a covered platform must otherwise comply with the requirements of the "Colorado Privacy Act". (Note: This summary applies to this bill as introduced.)