Colorado Children's Privacy Laws (2026)

SB26-051 — Age Attestation on Computing Devices

Enacted — not yet effective — Signed into law; its effective date is still in the future. · App store · effective 2028-07-01 · binds app stores, platforms, developers

Ages: minors (under 18; age-bracket signals to apps)

Requires: OS providers operating a covered app store must, at account setup, collect the user's birth date/age/age bracket and expose a real-time age-signal API; covered apps must request an age signal at first launch or account creation, to support compliance with minor-data protections under the Colorado Privacy Act. Civil penalty up to $2,500 per violation.

Litigation: None found as of 2026-06-27.

HB24-1136 — Healthier Social Media Use by Youth

Enacted — enjoined — Passed, but a court has currently blocked enforcement. · Social media · effective 2026-01-01 · binds platforms, operators

Ages: under 18

Requires: Social media platforms must provide users under 18 either information on social media's effects on developing brains/mental health OR a notification every 30 minutes once a minor has spent 1+ hour in 24 hours or is using the platform between 10 p.m. and 6 a.m. (this notification provision is enjoined). Also directs the Department of Education to build a resource bank for schools/parents.

Litigation: NetChoice v. Weiser, No. 1:25-cv-02538 (D. Colo.): preliminary injunction granted Nov 6, 2025 against the Section 4 notification mandate; Colorado appealed to the 10th Cir. (opening brief May 11, 2026); injunction NOT stayed and remains in force as of 2026-06-27.

HB26-1148 — Protections for Youth on Social Media

Pending — A bill was introduced this cycle but is not yet law. · Social media · binds platforms, operators

Ages: minors (under 18)

Requires: Would have barred social-media sites from subjecting minors to engagement-maximizing algorithms or sending push notifications between midnight and 6 a.m., required default-highest privacy settings, mandated privacy/algorithm disclosures and a 15-day minor account-deletion tool, and imposed a 5% fee on minors' in-game/add-on transactions. Did not become law.

Litigation: None — bill failed in committee; no litigation.

Colorado Privacy Protections for Children's Online Data (SB24-041) — child data-protection / AADC-style provisions · SB24-041

In force — Effective and enforceable today. · Design code · effective 2025-10-01 · binds operators

Ages: Minors under 18 (parental consent required for under-13; 13-17 may self-consent)

Requires: A controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) must use reasonable care to avoid a heightened risk of harm to minors and complete a data protection assessment where such risk exists. Absent required consent, it may not process a minor's data beyond what is reasonably necessary, may not collect precise geolocation, and may not use any system design feature to significantly increase, sustain, or extend the minor's use of the service.