Colorado
Colorado Privacy Act, biometric amendments (HB 24-1130)
Colorado’s 2024 amendment to its Privacy Act imported the core of BIPA without the lawsuits. Since July 2025, any entity collecting a biometric identifier in Colorado needs a written policy, a retention schedule, and consent before collection, and employers face some of the tightest limits anywhere on demanding biometrics from workers. Uniquely, the biometric provisions apply to businesses of any size, not just those over the CPA’s usual thresholds.
Key Provisions
- Consent required before collecting or processing a biometric identifier
- Written biometric policy with a retention schedule and deletion protocol, generally within 24 months
- Applies regardless of business size, unlike the rest of the CPA
- Employers may require biometrics only for narrow purposes (secure access, timekeeping, safety)
- Selling biometric identifiers effectively barred without explicit consent
Penalties & Enforcement Record
Violations are deceptive trade practices under the Colorado Consumer Protection Act: up to $20,000 per violation, enforced by the AG and district attorneys. No private right of action.
What this means for your face
Colorado gave residents BIPA-grade consent rules with regulator enforcement. Our removal requests for Coloradans cite the CPA’s biometric provisions and its universal application, small operators included.
Get Protected