Colorado Children's Privacy Laws (2026)

SB26-051: Age Attestation on Computing Devices

Enacted, not yet effective: Signed into law; its effective date is still in the future. · App store · effective 2028-07-01 · binds app stores, platforms, developers

Ages: minors (under 18; age-bracket signals to apps)

Requires: OS providers operating a covered app store must, at account setup, collect the user's birth date/age/age bracket and expose a real-time age-signal API; covered apps must request an age signal at first launch or account creation, to support compliance with minor-data protections under the Colorado Privacy Act. Civil penalty up to $2,500 per violation.

Litigation: None found.

Entry last reviewed 2026-07-18

HB24-1136: Healthier Social Media Use by Youth

Enacted, enjoined: Passed, but a court has currently blocked enforcement. · Social media · effective 2026-01-01 · binds platforms, operators

Ages: under 18

Requires: Social media platforms must provide users under 18 either information on social media's effects on developing brains/mental health OR a notification every 30 minutes once a minor has spent 1+ hour in 24 hours or is using the platform between 10 p.m. and 6 a.m. (this notification provision is enjoined). Also directs the Department of Education to build a resource bank for schools/parents.

Litigation: NetChoice v. Weiser, No. 1:25-cv-02538 (D. Colo.), on appeal as No. 25-1456 (10th Cir.): the district court's 2025-11-06 preliminary injunction bars enforcement of the Section 4 notification mandate and remains in effect during the appeal. Colorado filed its opening brief 2026-05-11 and NetChoice its response brief 2026-07-10; Colorado's optional reply brief is due 2026-08-14 under a clerk's order stating that no further extensions will be granted on the clerk's authority. NetChoice has requested oral argument, and no argument date has been set.

Entry last reviewed 2026-08-07

Colorado Privacy Protections for Children's Online Data (SB24-041): child data-protection / AADC-style provisions · SB24-041

In force: Effective and enforceable today. · Design code · effective 2025-10-01 · binds operators

Ages: Minors under 18 (parental consent required for under-13; 13-17 may self-consent)

Requires: A controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) must use reasonable care to avoid a heightened risk of harm to minors and complete a data protection assessment where such risk exists. Absent required consent, it may not process a minor's data beyond what is reasonably necessary, may not collect precise geolocation, and may not use any system design feature to significantly increase, sustain, or extend the minor's use of the service.

Entry last reviewed 2026-07-18

Conversational Artificial Intelligence Service Operator Requirements (HB26-1263) · HB26-1263 (Chapter 208, 2026 Session Laws)

Enacted, not yet effective: Signed into law; its effective date is still in the future. · AI companion · the act takes effect 2026-08-12, ninety days after the General Assembly's 2026-05-13 sine die adjournment, and is subject to a referendum petition filed within that window. The duties phase in: the age-estimation duty in C.R.S. 6-1-1708 (2) carries no date qualifier and so attaches on 2026-08-12, while the minor-specific duties, the consumer AI disclosure, the suicide and self-harm protocol and the false-representation ban all apply on and after 2027-01-01, and annual reporting to the Attorney General begins 2027-07-01. For a team shipping a kids' product the operational deadline is 2027-01-01 · binds operators

Ages: All users for the age-estimation duty; minor-specific duties (under 18) from 2027-01-01

Requires: Operators of conversational AI services (systems open to the public that primarily simulate human conversation through adaptive text, visual, or audio exchanges) must use commercially reasonable or generally accepted methods to estimate the age of account holders and users, and may not willfully disregard clear and convincing information that a user is a minor. An estimated age counts as knowledge of it. From 2027-01-01, where the operator knows a user is a minor it must disclose that the service is AI, may not offer points or rewards that encourage engagement, must take technically feasible measures against explicit sexual content, intimate digital depictions, and output simulating emotional dependence, must implement a protocol to stop responding to prompts about sexual conduct with a minor, and must give the minor or a parent tools to manage privacy and account settings. Also from 2027-01-01, every user gets an AI disclosure, operators must run a suicide and self-harm protocol, and may not present output as equivalent to a licensed professional's services. Annual reporting to the Attorney General starts 2027-07-01.

Litigation: None. Not challenged; no AI companion-chatbot law in any state has been sued over.

Entry last reviewed 2026-08-07