Privacy Map

Colorado. Biometric. Act

Colorado biometric amendmentColorado Privacy Act biometric identifier amendment (HB 24-1130)

In force
Partly verifiedMedium confidence. Signature date from established knowledge.

§1Summary

Synopsis

Requires any controller collecting biometric identifiers, regardless of CPA thresholds, to adopt a written retention and deletion policy, provide notice, obtain consent and respond to biometric access requests. Adds limits on employers' use of employee biometrics.

Key themes
  • biometric identifiers
  • written policy
  • retention
  • consent
  • employee biometrics
Unique features

Extends parts of the CPA to employee data, which the CPA otherwise excludes; applies without volume thresholds.

SaaS relevance

Identity, access-control and workforce SaaS processing biometrics of Colorado residents must support policy, consent and deletion obligations.

§2Obligations

Extraterritorial
Yes
Breach notification
Incident notification to affected individuals required under the amendment (timing as Colorado breach law)
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $20,000 per violation

§3Dates

Key dates
  • Adopted
  • In force
  • CPA rules amended to implement in 2025.

§4Text and authority

Text
Authority
Colorado Attorney General

§5Where it applies

Domestic law of
Colorado

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. Signature date from established knowledge.