Colorado Children’s Privacy Laws (2026)

Enacted, not yet effective · App store · effective 2028-07-01 · binds app stores, platforms, developers

Ages: minors (under 18; age-bracket signals to apps)

Requires: From 2028-07-01, an operating system provider that runs a covered app store, or ships one preinstalled, must have the account holder enter the device user's birth date, age or age bracket at account setup, and the provider or store must give developers a reasonably consistent, real-time API that returns an age signal (under 13, 13-15, 16-17, 18+), sending only the minimum information necessary. Covered apps must request the signal at first launch or account creation, are deemed to know the user's age range across all platforms, may not willfully disregard clear and convincing information that the user's age differs, and may use the signal only to comply with applicable law. The Attorney General can recover civil penalties of no more than $2,500 for each minor harmed by each negligent violation and no more than $7,500 for each minor harmed by each intentional violation; an OS provider or store that makes a good-faith effort to comply is not liable for an erroneous signal.

Timing: takes effect 2028-07-01 (2026 Colo. Sess. Laws ch. 343, sec. 3). For devices and apps already in use, C.R.S. 6-30-103 sets a later deadline: for a device whose account setup was completed before 2028-07-01, the operating system provider must offer the age interface before 2029-01-01, and a covered app last updated on or after 2027-07-01 that was downloaded before 2028-07-01 and has not yet requested a signal must request one before 2029-01-01

Litigation: None found.

Entry last reviewed 2026-10-01

Enacted, enjoined · Social media · effective 2026-01-01 · binds platforms, operators

Ages: under 18

Requires: Social media platforms with more than 100,000 active users in Colorado must, from 2026-01-01, establish a function that gives users under 18 information, supported by peer-reviewed research or the state's resource bank, about social media's impact on the developing brain and on mental and physical health; a platform may deliver it as a pop-up or full-screen notification to a user who attests to being under 18 after one cumulative hour on the platform in 24 hours or between 10 p.m. and 6 a.m., repeating at least every 30 minutes. That platform duty (C.R.S. 6-1-1601, both options) is preliminarily enjoined. The act also directs the Department of Education to build a free resource bank for schools and parents.

Timing: the platform duty at C.R.S. 6-1-1601 begins 2026-01-01 and is preliminarily enjoined (see litigation); the act itself took effect 2024-08-07, and its other provisions bind only state agencies, including a Department of Education resource bank that had to be available free of charge from 2025-07-01

Litigation: NetChoice v. Weiser, No. 1:25-cv-02538 (D. Colo.), on appeal as No. 25-1456 (10th Cir.): the district court's 2025-11-06 order preliminarily enjoins Colorado from enforcing Section 4 of the Act, which is the whole platform duty at C.R.S. 6-1-1601 (both the information option and the notification option). The injunction remains in effect during the appeal, and district-court proceedings are stayed pending the appeal. Colorado filed its opening brief 2026-05-11, NetChoice its response brief 2026-07-10, and Colorado its reply brief on 2026-08-14, the extended deadline the clerk had set, so merits briefing is complete. Amici include CCIA with SIIA, a coalition of the ACLU, the ACLU of Colorado, EFF, FIRE and Woodhull, Common Sense Media with Healthier Colorado, and a large multistate brief. In-person oral argument had been set for 2026-11-16 in Denver (argument notice, docket entry 90, filed 2026-09-10). On 2026-09-22 the court, at the direction of the merits panel, granted Colorado's unopposed motion to reschedule (entries 92 and 93), vacated that setting and said counsel will be notified of a new date later; the court's November 2026 argument calendar does not list the case. Colorado's Attorney General Philip J. Weiser is the appellant and NetChoice the appellee.

Entry last reviewed 2026-10-01

SB24-041

In force · Design code · effective 2025-10-01 · binds operators

Ages: Minors under 18 (parental consent required for under-13; 13-17 may self-consent)

Requires: A controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) must use reasonable care to avoid any heightened risk of harm to minors and, where such a risk exists, complete a data protection assessment and a plan to mitigate it. Without the minor's consent (a parent's, for a child under 13), it may not process the minor's data for targeted advertising, sale, or profiling for decisions with legal or similarly significant effects, for purposes not disclosed at collection or compatible with them, or for longer than reasonably necessary, and may not use any system design feature to significantly increase, sustain, or extend the minor's use. Without consent it may collect precise geolocation only when reasonably necessary for the service, kept only as long as needed, and with a signal shown to the minor for the whole time it is collected; it also may not use manipulative consent mechanisms.

Entry last reviewed 2026-10-01

HB26-1263 (Chapter 208, 2026 Session Laws)

In force · AI companion · effective 2026-08-12 · binds operators

Ages: All users for the age-estimation duty; minor-specific duties (under 18) from 2027-01-01

AI chatbot access for minors: Age check, no block (in force).

Requires: Operators of conversational AI services (systems open to the public that primarily simulate human conversation through adaptive text, visual, or audio exchanges) must use commercially reasonable or generally accepted methods to estimate the age of account holders or users, and may not willfully disregard clear and convincing information that a user is a minor; an estimated age counts as knowledge of it. From 2027-01-01, where the operator knows a user is a minor it must disclose that the service is AI, may not give points or similar rewards at unpredictable intervals to drive engagement, must take technically feasible measures to block sexually explicit output and intimate digital depictions and reasonable measures against responses that simulate emotional dependence or romantic companionship, must run protocols that bar explicit sexual conduct with a minor, and must offer the minor tools to manage privacy and account settings (including memory of past sessions and use of their data for training) and offer a parent tools to manage them too. Also from 2027-01-01, every user gets an AI disclosure, operators must run a suicide and self-harm protocol with crisis referrals, and may not present output as provided by or equivalent to a licensed professional's services. Annual reporting to the Attorney General starts 2027-07-01.

Timing: the act took effect 2026-08-12, ninety days after the General Assembly's 2026-05-13 sine die adjournment; no referendum petition put it on the November 2026 ballot. The duties phase in: the age-estimation duty in C.R.S. 6-1-1708 (2) carries no date qualifier and so attaches on 2026-08-12, while the minor-specific duties, the consumer AI disclosure, the suicide and self-harm protocol and the false-representation ban all apply on and after 2027-01-01, and annual reporting to the Attorney General begins 2027-07-01. For a team shipping a kids' product the operational deadline is 2027-01-01

Litigation: None found. No lawsuit challenges this act.

Entry last reviewed 2026-10-01