# An Act

## SENATE BILL 21-190

**BY SENATOR(S) Rodriguez and Lundeen, Bridges, Buckner, Coleman, Cooke, Danielson, Donovan, Fenberg, Gardner, Ginal, Gonzales, Hansen, Hisey, Holbert, Jaquez Lewis, Kirkmeyer, Kolker, Lee, Liston, Moreno, Pettersen, Priola, Rankin, Scott, Simpson, Sonnenberg, Story, Winter, Woodward, Garcia;
also REPRESENTATIVE(S) Duran and Carver, Bernett, Bird, Cutter, Exum, Gonzales-Gutierrez, Gray, Herod, Jodeh, Lynch, McCluskie, McCormick, Mullica, Ricks, Snyder, Titone, Valdez A., Woodrow.**

**CONCERNING ADDITIONAL PROTECTION OF DATA RELATING TO PERSONAL PRIVACY.**

*Be it enacted by the General Assembly of the State of Colorado:*

### SECTION 1.
In Colorado Revised Statutes, **add** part 13 to article 1 of title 6 as follows:

#### PART 13
#### COLORADO PRIVACY ACT

**6-1-1301. Short title.** THE SHORT TITLE OF THIS PART 13 IS THE "COLORADO PRIVACY ACT".

*Capital letters or bold & italic numbers indicate new material added to existing law; dashes through words or numbers indicate deletions from existing law and such material is not part of the act.*
---
# 6-1-1302. Legislative declaration.

(1) THE GENERAL ASSEMBLY HEREBY:

## (a) FINDS THAT:

(I) THE PEOPLE OF COLORADO REGARD THEIR PRIVACY AS A FUNDAMENTAL RIGHT AND AN ESSENTIAL ELEMENT OF THEIR INDIVIDUAL FREEDOM;

(II) COLORADO'S CONSTITUTION EXPLICITLY PROVIDES THE RIGHT TO PRIVACY UNDER SECTION 7 OF ARTICLE II, AND FUNDAMENTAL PRIVACY RIGHTS HAVE LONG BEEN, AND CONTINUE TO BE, INTEGRAL TO PROTECTING COLORADANS AND TO SAFEGUARDING OUR DEMOCRATIC REPUBLIC;

(III) ONGOING ADVANCES IN TECHNOLOGY HAVE PRODUCED EXPONENTIAL GROWTH IN THE VOLUME AND VARIETY OF PERSONAL DATA BEING GENERATED, COLLECTED, STORED, AND ANALYZED AND THESE ADVANCES PRESENT BOTH PROMISE AND POTENTIAL PERIL;

(IV) THE ABILITY TO HARNESS AND USE DATA IN POSITIVE WAYS IS DRIVING INNOVATION AND BRINGS BENEFICIAL TECHNOLOGIES TO SOCIETY, BUT IT HAS ALSO CREATED RISKS TO PRIVACY AND FREEDOM; AND

(V) THE UNAUTHORIZED DISCLOSURE OF PERSONAL INFORMATION AND LOSS OF PRIVACY CAN HAVE DEVASTATING IMPACTS RANGING FROM FINANCIAL FRAUD, IDENTITY THEFT, AND UNNECESSARY COSTS IN PERSONAL TIME AND FINANCES TO DESTRUCTION OF PROPERTY, HARASSMENT, REPUTATIONAL DAMAGE, EMOTIONAL DISTRESS, AND PHYSICAL HARM;

## (b) DETERMINES THAT:

(I) TECHNOLOGICAL INNOVATION AND NEW USES OF DATA CAN HELP SOLVE SOCIETAL PROBLEMS AND IMPROVE LIVES, AND IT IS POSSIBLE TO BUILD A WORLD WHERE TECHNOLOGICAL INNOVATION AND PRIVACY CAN COEXIST; AND

(II) STATES ACROSS THE UNITED STATES ARE LOOKING TO THIS PART 13 AND SIMILAR MODELS TO ENACT STATE-BASED DATA PRIVACY REQUIREMENTS AND TO EXERCISE THE LEADERSHIP THAT IS LACKING AT THE
---
# NATIONAL LEVEL; AND

(c) DECLARES THAT:

(I) BY ENACTING THIS PART 13, COLORADO WILL BE AMONG THE STATES THAT EMPOWER CONSUMERS TO PROTECT THEIR PRIVACY AND REQUIRE COMPANIES TO BE RESPONSIBLE CUSTODIANS OF DATA AS THEY CONTINUE TO INNOVATE;

(II) THIS PART 13 ADDRESSES ISSUES OF STATEWIDE CONCERN AND:

(A) PROVIDES CONSUMERS THE RIGHT TO ACCESS, CORRECT, AND DELETE PERSONAL DATA AND THE RIGHT TO OPT OUT NOT ONLY OF THE SALE OF PERSONAL DATA BUT ALSO OF THE COLLECTION AND USE OF PERSONAL DATA;

(B) IMPOSES AN AFFIRMATIVE OBLIGATION UPON COMPANIES TO SAFEGUARD PERSONAL DATA; TO PROVIDE CLEAR, UNDERSTANDABLE, AND TRANSPARENT INFORMATION TO CONSUMERS ABOUT HOW THEIR PERSONAL DATA ARE USED; AND TO STRENGTHEN COMPLIANCE AND ACCOUNTABILITY BY REQUIRING DATA PROTECTION ASSESSMENTS IN THE COLLECTION AND USE OF PERSONAL DATA; AND

(C) EMPOWERS THE ATTORNEY GENERAL AND DISTRICT ATTORNEYS TO ACCESS AND EVALUATE A COMPANY'S DATA PROTECTION ASSESSMENTS, TO IMPOSE PENALTIES WHERE VIOLATIONS OCCUR, AND TO PREVENT FUTURE VIOLATIONS.

## 6-1-1303. Definitions.

AS USED IN THIS PART 13, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(1) "AFFILIATE" MEANS A LEGAL ENTITY THAT CONTROLS, IS CONTROLLED BY, OR IS UNDER COMMON CONTROL WITH ANOTHER LEGAL ENTITY. AS USED IN THIS SUBSECTION (1), "CONTROL" MEANS:

(a) OWNERSHIP OF, CONTROL OF, OR POWER TO VOTE TWENTY-FIVE PERCENT OR MORE OF THE OUTSTANDING SHARES OF ANY CLASS OF VOTING SECURITY OF THE ENTITY, DIRECTLY OR INDIRECTLY, OR ACTING THROUGH ONE OR MORE OTHER PERSONS;

PAGE 3-SENATE BILL 21-190
---
(b) CONTROL IN ANY MANNER OVER THE ELECTION OF A MAJORITY OF THE DIRECTORS, TRUSTEES, OR GENERAL PARTNERS OF THE ENTITY OR OF INDIVIDUALS EXERCISING SIMILAR FUNCTIONS; OR

(c) THE POWER TO EXERCISE, DIRECTLY OR INDIRECTLY, A CONTROLLING INFLUENCE OVER THE MANAGEMENT OR POLICIES OF THE ENTITY AS DETERMINED BY THE APPLICABLE PRUDENTIAL REGULATOR, AS THAT TERM IS DEFINED IN 12 U.S.C. SEC. 5481 (24), IF ANY.

(2) "AUTHENTICATE" MEANS TO USE REASONABLE MEANS TO DETERMINE THAT A REQUEST TO EXERCISE ANY OF THE RIGHTS IN SECTION 6-1-1306 (1) IS BEING MADE BY OR ON BEHALF OF THE CONSUMER WHO IS ENTITLED TO EXERCISE THE RIGHTS.

(3) "BUSINESS ASSOCIATE" HAS THE MEANING ESTABLISHED IN 45 CFR 160.103.

(4) "CHILD" MEANS AN INDIVIDUAL UNDER THIRTEEN YEARS OF AGE.

(5) "CONSENT" MEANS A CLEAR, AFFIRMATIVE ACT SIGNIFYING A CONSUMER'S FREELY GIVEN, SPECIFIC, INFORMED, AND UNAMBIGUOUS AGREEMENT, SUCH AS BY A WRITTEN STATEMENT, INCLUDING BY ELECTRONIC MEANS, OR OTHER CLEAR, AFFIRMATIVE ACTION BY WHICH THE CONSUMER SIGNIFIES AGREEMENT TO THE PROCESSING OF PERSONAL DATA. THE FOLLOWING DOES NOT CONSTITUTE CONSENT:

(a) ACCEPTANCE OF A GENERAL OR BROAD TERMS OF USE OR SIMILAR DOCUMENT THAT CONTAINS DESCRIPTIONS OF PERSONAL DATA PROCESSING ALONG WITH OTHER, UNRELATED INFORMATION;

(b) HOVERING OVER, MUTING, PAUSING, OR CLOSING A GIVEN PIECE OF CONTENT; AND

(c) AGREEMENT OBTAINED THROUGH DARK PATTERNS.

(6) "CONSUMER":

(a) MEANS AN INDIVIDUAL WHO IS A COLORADO RESIDENT ACTING ONLY IN AN INDIVIDUAL OR HOUSEHOLD CONTEXT; AND

PAGE 4-SENATE BILL 21-190
---
(b) DOES NOT INCLUDE AN INDIVIDUAL ACTING IN A COMMERCIAL OR EMPLOYMENT CONTEXT, AS A JOB APPLICANT, OR AS A BENEFICIARY OF SOMEONE ACTING IN AN EMPLOYMENT CONTEXT.

(7) "CONTROLLER" MEANS A PERSON THAT, ALONE OR JOINTLY WITH OTHERS, DETERMINES THE PURPOSES FOR AND MEANS OF PROCESSING PERSONAL DATA.

(8) "COVERED ENTITY" HAS THE MEANING ESTABLISHED IN 45 CFR 160.103.

(9) "DARK PATTERN" MEANS A USER INTERFACE DESIGNED OR MANIPULATED WITH THE SUBSTANTIAL EFFECT OF SUBVERTING OR IMPAIRING USER AUTONOMY, DECISION-MAKING, OR CHOICE.

(10) "DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER" MEANS A DECISION THAT RESULTS IN THE PROVISION OR DENIAL OF FINANCIAL OR LENDING SERVICES, HOUSING, INSURANCE, EDUCATION ENROLLMENT OR OPPORTUNITY, CRIMINAL JUSTICE, EMPLOYMENT OPPORTUNITIES, HEALTH-CARE SERVICES, OR ACCESS TO ESSENTIAL GOODS OR SERVICES.

(11) "DE-IDENTIFIED DATA" MEANS DATA THAT CANNOT REASONABLY BE USED TO INFER INFORMATION ABOUT, OR OTHERWISE BE LINKED TO, AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL, OR A DEVICE LINKED TO SUCH AN INDIVIDUAL, IF THE CONTROLLER THAT POSSESSES THE DATA:

(a) TAKES REASONABLE MEASURES TO ENSURE THAT THE DATA CANNOT BE ASSOCIATED WITH AN INDIVIDUAL;

(b) PUBLICLY COMMITS TO MAINTAIN AND USE THE DATA ONLY IN A DE-IDENTIFIED FASHION AND NOT ATTEMPT TO RE-IDENTIFY THE DATA; AND

(c) CONTRACTUALLY OBLIGATES ANY RECIPIENTS OF THE INFORMATION TO COMPLY WITH THE REQUIREMENTS OF THIS SUBSECTION (11).

(12) "HEALTH-CARE FACILITY" MEANS ANY ENTITY THAT IS LICENSED, CERTIFIED, OR OTHERWISE AUTHORIZED OR PERMITTED BY LAW

PAGE 5-SENATE BILL 21-190
---
TO ADMINISTER MEDICAL TREATMENT IN THIS STATE.

(13) "HEALTH-CARE INFORMATION" MEANS INDIVIDUALLY IDENTIFIABLE INFORMATION RELATING TO THE PAST, PRESENT, OR FUTURE HEALTH STATUS OF AN INDIVIDUAL.

(14) "HEALTH-CARE PROVIDER" MEANS A PERSON LICENSED, CERTIFIED, OR REGISTERED IN THIS STATE TO PRACTICE MEDICINE, PHARMACY, CHIROPRACTIC, NURSING, PHYSICAL THERAPY, PODIATRY, DENTISTRY, OPTOMETRY, OCCUPATIONAL THERAPY, OR OTHER HEALING ARTS UNDER TITLE 12.

(15) "HIPAA" MEANS THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", AS AMENDED, 42 U.S.C. SECS. 1320d TO 1320d-9.

(16) "IDENTIFIED OR IDENTIFIABLE INDIVIDUAL" MEANS AN INDIVIDUAL WHO CAN BE READILY IDENTIFIED, DIRECTLY OR INDIRECTLY, IN PARTICULAR BY REFERENCE TO AN IDENTIFIER SUCH AS A NAME, AN IDENTIFICATION NUMBER, SPECIFIC GEOLOCATION DATA, OR AN ONLINE IDENTIFIER.

(17) "PERSONAL DATA":

(a) MEANS INFORMATION THAT IS LINKED OR REASONABLY LINKABLE TO AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL; AND

(b) DOES NOT INCLUDE DE-IDENTIFIED DATA OR PUBLICLY AVAILABLE INFORMATION. AS USED IN THIS SUBSECTION (17)(b), "PUBLICLY AVAILABLE INFORMATION" MEANS INFORMATION THAT IS LAWFULLY MADE AVAILABLE FROM FEDERAL, STATE, OR LOCAL GOVERNMENT RECORDS AND INFORMATION THAT A CONTROLLER HAS A REASONABLE BASIS TO BELIEVE THE CONSUMER HAS LAWFULLY MADE AVAILABLE TO THE GENERAL PUBLIC.

(18) "PROCESS" OR "PROCESSING" MEANS THE COLLECTION, USE, SALE, STORAGE, DISCLOSURE, ANALYSIS, DELETION, OR MODIFICATION OF PERSONAL DATA AND INCLUDES THE ACTIONS OF A CONTROLLER DIRECTING A PROCESSOR TO PROCESS PERSONAL DATA.

(19) "PROCESSOR" MEANS A PERSON THAT PROCESSES PERSONAL

PAGE 6-SENATE BILL 21-190
---
DATA ON BEHALF OF A CONTROLLER.

(20) "PROFILING" MEANS ANY FORM OF AUTOMATED PROCESSING OF PERSONAL DATA TO EVALUATE, ANALYZE, OR PREDICT PERSONAL ASPECTS CONCERNING AN IDENTIFIED OR IDENTIFIABLE INDIVIDUAL'S ECONOMIC SITUATION, HEALTH, PERSONAL PREFERENCES, INTERESTS, RELIABILITY, BEHAVIOR, LOCATION, OR MOVEMENTS.

(21) "PROTECTED HEALTH INFORMATION" HAS THE MEANING ESTABLISHED IN 45 CFR 160.103.

(22) "PSEUDONYMOUS DATA" MEANS PERSONAL DATA THAT CAN NO LONGER BE ATTRIBUTED TO A SPECIFIC INDIVIDUAL WITHOUT THE USE OF ADDITIONAL INFORMATION IF THE ADDITIONAL INFORMATION IS KEPT SEPARATELY AND IS SUBJECT TO TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE THAT THE PERSONAL DATA ARE NOT ATTRIBUTED TO A SPECIFIC INDIVIDUAL.

(23) (a) "SALE", "SELL", OR "SOLD" MEANS THE EXCHANGE OF PERSONAL DATA FOR MONETARY OR OTHER VALUABLE CONSIDERATION BY A CONTROLLER TO A THIRD PARTY.

(b) "SALE", "SELL", OR "SOLD" DOES NOT INCLUDE THE FOLLOWING:

(I) THE DISCLOSURE OF PERSONAL DATA TO A PROCESSOR THAT PROCESSES THE PERSONAL DATA ON BEHALF OF A CONTROLLER;

(II) THE DISCLOSURE OF PERSONAL DATA TO A THIRD PARTY FOR PURPOSES OF PROVIDING A PRODUCT OR SERVICE REQUESTED BY THE CONSUMER;

(III) THE DISCLOSURE OR TRANSFER OF PERSONAL DATA TO AN AFFILIATE OF THE CONTROLLER;

(IV) THE DISCLOSURE OR TRANSFER TO A THIRD PARTY OF PERSONAL DATA AS AN ASSET THAT IS PART OF A PROPOSED OR ACTUAL MERGER, ACQUISITION, BANKRUPTCY, OR OTHER TRANSACTION IN WHICH THE THIRD PARTY ASSUMES CONTROL OF ALL OR PART OF THE CONTROLLER'S ASSETS; OR

---

PAGE 7-SENATE BILL 21-190
---
```
(V) THE DISCLOSURE OF PERSONAL DATA:

(A) THAT A CONSUMER DIRECTS THE CONTROLLER TO DISCLOSE OR INTENTIONALLY DISCLOSES BY USING THE CONTROLLER TO INTERACT WITH A THIRD PARTY; OR

(B) INTENTIONALLY MADE AVAILABLE BY A CONSUMER TO THE GENERAL PUBLIC VIA A CHANNEL OF MASS MEDIA.

(24) "SENSITIVE DATA" MEANS:

(a) PERSONAL DATA REVEALING RACIAL OR ETHNIC ORIGIN, RELIGIOUS BELIEFS, A MENTAL OR PHYSICAL HEALTH CONDITION OR DIAGNOSIS, SEX LIFE OR SEXUAL ORIENTATION, OR CITIZENSHIP OR CITIZENSHIP STATUS;

(b) GENETIC OR BIOMETRIC DATA THAT MAY BE PROCESSED FOR THE PURPOSE OF UNIQUELY IDENTIFYING AN INDIVIDUAL; OR

(c) PERSONAL DATA FROM A KNOWN CHILD.

(25) "TARGETED ADVERTISING":

(a) MEANS DISPLAYING TO A CONSUMER AN ADVERTISEMENT THAT IS SELECTED BASED ON PERSONAL DATA OBTAINED OR INFERRED OVER TIME FROM THE CONSUMER'S ACTIVITIES ACROSS NONAFFILIATED WEBSITES, APPLICATIONS, OR ONLINE SERVICES TO PREDICT CONSUMER PREFERENCES OR INTERESTS; AND

(b) DOES NOT INCLUDE:

(I) ADVERTISING TO A CONSUMER IN RESPONSE TO THE CONSUMER'S REQUEST FOR INFORMATION OR FEEDBACK;

(II) ADVERTISEMENTS BASED ON ACTIVITIES WITHIN A CONTROLLER'S OWN WEBSITES OR ONLINE APPLICATIONS;

(III) ADVERTISEMENTS BASED ON THE CONTEXT OF A CONSUMER'S CURRENT SEARCH QUERY, VISIT TO A WEBSITE, OR ONLINE APPLICATION; OR

PAGE 8-SENATE BILL 21-190
```
---
```
(IV) PROCESSING PERSONAL DATA SOLELY FOR MEASURING OR REPORTING ADVERTISING PERFORMANCE, REACH, OR FREQUENCY.

(26) "THIRD PARTY" MEANS A PERSON, PUBLIC AUTHORITY, AGENCY, OR BODY OTHER THAN A CONSUMER, CONTROLLER, PROCESSOR, OR AFFILIATE OF THE PROCESSOR OR THE CONTROLLER.

### 6-1-1304. Applicability of part.
(1) EXCEPT AS SPECIFIED IN SUBSECTION (2) OF THIS SECTION, THIS PART 13 APPLIES TO A CONTROLLER THAT:

(a) CONDUCTS BUSINESS IN COLORADO OR PRODUCES OR DELIVERS COMMERCIAL PRODUCTS OR SERVICES THAT ARE INTENTIONALLY TARGETED TO RESIDENTS OF COLORADO; AND

(b) SATISFIES ONE OR BOTH OF THE FOLLOWING THRESHOLDS:

(I) CONTROLS OR PROCESSES THE PERSONAL DATA OF ONE HUNDRED THOUSAND CONSUMERS OR MORE DURING A CALENDAR YEAR; OR

(II) DERIVES REVENUE OR RECEIVES A DISCOUNT ON THE PRICE OF GOODS OR SERVICES FROM THE SALE OF PERSONAL DATA AND PROCESSES OR CONTROLS THE PERSONAL DATA OF TWENTY-FIVE THOUSAND CONSUMERS OR MORE.

(2) THIS PART 13 DOES NOT APPLY TO:

(a) PROTECTED HEALTH INFORMATION THAT IS COLLECTED, STORED, AND PROCESSED BY A COVERED ENTITY OR ITS BUSINESS ASSOCIATES;

(b) HEALTH-CARE INFORMATION THAT IS GOVERNED BY PART 8 OF ARTICLE 1 OF TITLE 25 SOLELY FOR THE PURPOSE OF ACCESS TO MEDICAL RECORDS;

(c) PATIENT IDENTIFYING INFORMATION, AS DEFINED IN 42 CFR 2.11, THAT ARE GOVERNED BY AND COLLECTED AND PROCESSED PURSUANT TO 42 CFR 2, ESTABLISHED PURSUANT TO 42 U.S.C. SEC. 290dd-2;

(d) IDENTIFIABLE PRIVATE INFORMATION, AS DEFINED IN 45 CFR 46.102, FOR PURPOSES OF THE FEDERAL POLICY FOR THE PROTECTION OF

PAGE 9-SENATE BILL 21-190
```
---
# HUMAN SUBJECTS PURSUANT TO 45 CFR 46

Identifiable private information that is collected as part of human subjects research pursuant to the ICH E6 Good Clinical Practice Guideline issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or the protection of human subjects under 21 CFR 50 and 56; or personal data used or shared in research conducted in accordance with one or more of the categories set forth in this subsection (2)(d);

(e) Information and documents created by a covered entity for purposes of complying with HIPAA and its implementing regulations;

(f) Patient safety work product, as defined in 42 CFR 3.20, that is created for purposes of patient safety improvement pursuant to 42 CFR 3, established pursuant to 42 U.S.C. secs. 299b-21 to 299b-26;

(g) Information that is:

(I) De-identified in accordance with the requirements for de-identification set forth in 45 CFR 164; and

(II) Derived from any of the health-care-related information described in this section.

(h) Information maintained in the same manner as information under subsections (2)(a) to (2)(g) of this section by:

(I) A covered entity or business associate;

(II) A health-care facility or health-care provider; or

(III) A program of a qualified service organization as defined in 42 CFR 2.11;

(i) (I) Except as provided in subsection (2)(i)(II) of this section, an activity involving the collection, maintenance, disclosure, sale, communication, or use of any personal data bearing on a consumer's creditworthiness, credit standing, credit

---

PAGE 10-SENATE BILL 21-190
---
CAPACITY, CHARACTER, GENERAL REPUTATION, PERSONAL CHARACTERISTICS, OR MODE OF LIVING BY:

(A) A CONSUMER REPORTING AGENCY AS DEFINED IN 15 U.S.C. SEC. 1681a(f);

(B) A FURNISHER OF INFORMATION AS SET FORTH IN 15 U.S.C. SEC. 1681s-2 THAT PROVIDES INFORMATION FOR USE IN A CONSUMER REPORT, AS DEFINED IN 15 U.S.C. SEC. 1681a(d); OR

(C) A USER OF A CONSUMER REPORT AS SET FORTH IN 15 U.S.C. SEC. 1681b.

(II) THIS SUBSECTION (2)(i) APPLIES ONLY TO THE EXTENT THAT THE ACTIVITY IS REGULATED BY THE FEDERAL "FAIR CREDIT REPORTING ACT", 15 U.S.C. SEC. 1681 ET SEQ., AS AMENDED, AND THE PERSONAL DATA ARE NOT COLLECTED, MAINTAINED, DISCLOSED, SOLD, COMMUNICATED, OR USED EXCEPT AS AUTHORIZED BY THE FEDERAL "FAIR CREDIT REPORTING ACT", AS AMENDED.

(j) PERSONAL DATA:

(I) COLLECTED AND MAINTAINED FOR PURPOSES OF ARTICLE 22 OF TITLE 10;

(II) COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO THE FEDERAL "GRAMM-LEACH-BLILEY ACT", 15 U.S.C. SEC. 6801 ET SEQ., AS AMENDED, AND IMPLEMENTING REGULATIONS, IF THE COLLECTION, PROCESSING, SALE, OR DISCLOSURE IS IN COMPLIANCE WITH THAT LAW;

(III) COLLECTED, PROCESSED, SOLD, OR DISCLOSED PURSUANT TO THE FEDERAL "DRIVER'S PRIVACY PROTECTION ACT OF 1994", 18 U.S.C. SEC. 2721 ET SEQ., AS AMENDED, IF THE COLLECTION, PROCESSING, SALE, OR DISCLOSURE IS REGULATED BY THAT LAW, INCLUDING IMPLEMENTING RULES, REGULATIONS, OR EXEMPTIONS;

(IV) REGULATED BY THE FEDERAL "CHILDREN'S ONLINE PRIVACY PROTECTION ACT OF 1998", 15 U.S.C. SECS. 6501 TO 6506, AS AMENDED, IF COLLECTED, PROCESSED, AND MAINTAINED IN COMPLIANCE WITH THAT LAW; OR

PAGE 11-SENATE BILL 21-190
---
```
(V) REGULATED BY THE FEDERAL "FAMILY EDUCATIONAL RIGHTS AND PRIVACY ACT OF 1974", 20 U.S.C. SEC. 1232g ET SEQ., AS AMENDED, AND ITS IMPLEMENTING REGULATIONS;

(k) DATA MAINTAINED FOR EMPLOYMENT RECORDS PURPOSES;

(l) AN AIR CARRIER AS DEFINED IN AND REGULATED UNDER 49 U.S.C. SEC. 40101 ET SEQ., AS AMENDED, AND 49 U.S.C. SEC. 41713, AS AMENDED;

(m) A NATIONAL SECURITIES ASSOCIATION REGISTERED PURSUANT TO THE FEDERAL "SECURITIES EXCHANGE ACT OF 1934", 15 U.S.C. SEC. 78o-3, AS AMENDED, OR IMPLEMENTING REGULATIONS;

(n) CUSTOMER DATA MAINTAINED BY A PUBLIC UTILITY AS DEFINED IN SECTION 40-1-103 (1)(a)(I) OR AN AUTHORITY AS DEFINED IN SECTION 43-4-503 (1), IF THE DATA ARE NOT COLLECTED, MAINTAINED, DISCLOSED, SOLD, COMMUNICATED, OR USED EXCEPT AS AUTHORIZED BY STATE AND FEDERAL LAW;

(o) DATA MAINTAINED BY A STATE INSTITUTION OF HIGHER EDUCATION, AS DEFINED IN SECTION 23-18-102 (10), THE STATE, THE JUDICIAL DEPARTMENT OF THE STATE, OR A COUNTY, CITY AND COUNTY, OR MUNICIPALITY IF THE DATA IS COLLECTED, MAINTAINED, DISCLOSED, COMMUNICATED, AND USED AS AUTHORIZED BY STATE AND FEDERAL LAW FOR NONCOMMERCIAL PURPOSES. THIS SUBSECTION (2)(o) DOES NOT EFFECT ANY OTHER EXEMPTION AVAILABLE UNDER THIS PART 13.

(p) INFORMATION USED AND DISCLOSED IN COMPLIANCE WITH 45 CFR 164.512; OR

(q) A FINANCIAL INSTITUTION OR AN AFFILIATE OF A FINANCIAL INSTITUTION AS DEFINED BY AND THAT IS SUBJECT TO THE FEDERAL "Gramm-Leach-Bliley Act", 15 U.S.C. SEC. 6801 ET SEQ., AS AMENDED, AND IMPLEMENTING REGULATIONS, INCLUDING REGULATION P, 12 CFR 1016.

(3) THE OBLIGATIONS IMPOSED ON CONTROLLERS OR PROCESSORS UNDER THIS PART 13 DO NOT:

(a) RESTRICT A CONTROLLER'S OR PROCESSOR'S ABILITY TO:
```

---
```
(I) COMPLY WITH FEDERAL, STATE, OR LOCAL LAWS, RULES, OR REGULATIONS;

(II) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY FEDERAL, STATE, LOCAL, OR OTHER GOVERNMENTAL AUTHORITIES;

(III) COOPERATE WITH LAW ENFORCEMENT AGENCIES CONCERNING CONDUCT OR ACTIVITY THAT THE CONTROLLER OR PROCESSOR REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR LOCAL LAW;

(IV) INVESTIGATE, EXERCISE, PREPARE FOR, OR DEFEND ACTUAL OR ANTICIPATED LEGAL CLAIMS;

(V) CONDUCT INTERNAL RESEARCH TO IMPROVE, REPAIR, OR DEVELOP PRODUCTS, SERVICES, OR TECHNOLOGY;

(VI) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING OR INTENDED FUNCTIONALITY;

(VII) PERFORM INTERNAL OPERATIONS THAT ARE REASONABLY ALIGNED WITH THE EXPECTATIONS OF THE CONSUMER BASED ON THE CONSUMER'S EXISTING RELATIONSHIP WITH THE CONTROLLER;

(VIII) PROVIDE A PRODUCT OR SERVICE SPECIFICALLY REQUESTED BY A CONSUMER OR THE PARENT OR GUARDIAN OF A CHILD, PERFORM A CONTRACT TO WHICH THE CONSUMER IS A PARTY, OR TAKE STEPS AT THE REQUEST OF THE CONSUMER PRIOR TO ENTERING INTO A CONTRACT;

(IX) PROTECT THE VITAL INTERESTS OF THE CONSUMER OR OF ANOTHER INDIVIDUAL;

(X) PREVENT, DETECT, PROTECT AGAINST, OR RESPOND TO SECURITY INCIDENTS, IDENTITY THEFT, FRAUD, HARASSMENT, OR MALICIOUS, DECEPTIVE, OR ILLEGAL ACTIVITY; PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS; OR INVESTIGATE, REPORT, OR PROSECUTE THOSE RESPONSIBLE FOR ANY SUCH ACTION;

(XI) PROCESS PERSONAL DATA FOR REASONS OF PUBLIC INTEREST IN
```

---
the area of public health, but solely to the extent that the processing:

(A) Is subject to suitable and specific measures to safeguard the rights of the consumer whose personal data are processed; and

(B) Is under the responsibility of a professional subject to confidentiality obligations under federal, state, or local law; or

(XII) Assist another person with any of the activities set forth in this subsection (3);

(b) Apply where compliance by the controller or processor with this part 13 would violate an evidentiary privilege under Colorado law;

(c) Prevent a controller or processor from providing personal data concerning a consumer to a person covered by an evidentiary privilege under Colorado law as part of a privileged communication;

(d) Apply to information made available by a third party that the controller has a reasonable basis to believe is protected speech pursuant to applicable law; and

(e) Apply to the processing of personal data by an individual in the course of a purely personal or household activity.

(4) Personal data that are processed by a controller pursuant to an exception provided by this section:

(a) Shall not be processed for any purpose other than a purpose expressly listed in this section or as otherwise authorized by this part 13; and

(b) Shall be processed solely to the extent that the processing is necessary, reasonable, and proportionate to the specific purpose or purposes listed in this section or as otherwise

Page 14-Senate Bill 21-190
---
AUTHORIZED BY THIS PART 13.

(5) IF A CONTROLLER PROCESSES PERSONAL DATA PURSUANT TO AN EXEMPTION IN THIS SECTION, THE CONTROLLER BEARS THE BURDEN OF DEMONSTRATING THAT THE PROCESSING QUALIFIES FOR THE EXEMPTION AND COMPLIES WITH THE REQUIREMENTS IN SUBSECTION (4) OF THIS SECTION.

### 6-1-1305. Responsibility according to role.
(1) CONTROLLERS AND PROCESSORS SHALL MEET THEIR RESPECTIVE OBLIGATIONS ESTABLISHED UNDER THIS PART 13.

(2) PROCESSORS SHALL ADHERE TO THE INSTRUCTIONS OF THE CONTROLLER AND ASSIST THE CONTROLLER TO MEET ITS OBLIGATIONS UNDER THIS PART 13. TAKING INTO ACCOUNT THE NATURE OF PROCESSING AND THE INFORMATION AVAILABLE TO THE PROCESSOR, THE PROCESSOR SHALL ASSIST THE CONTROLLER BY:

(a) TAKING APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES, INSOFAR AS THIS IS POSSIBLE, FOR THE FULFILLMENT OF THE CONTROLLER'S OBLIGATION TO RESPOND TO CONSUMER REQUESTS TO EXERCISE THEIR RIGHTS PURSUANT TO SECTION 6-1-1306;

(b) HELPING TO MEET THE CONTROLLER'S OBLIGATIONS IN RELATION TO THE SECURITY OF PROCESSING THE PERSONAL DATA AND IN RELATION TO THE NOTIFICATION OF A BREACH OF THE SECURITY OF THE SYSTEM PURSUANT TO SECTION 6-1-716; AND

(c) PROVIDING INFORMATION TO THE CONTROLLER NECESSARY TO ENABLE THE CONTROLLER TO CONDUCT AND DOCUMENT ANY DATA PROTECTION ASSESSMENTS REQUIRED BY SECTION 6-1-1309. THE CONTROLLER AND PROCESSOR ARE EACH RESPONSIBLE FOR ONLY THE MEASURES ALLOCATED TO THEM.

(3) NOTWITHSTANDING THE INSTRUCTIONS OF THE CONTROLLER, A PROCESSOR SHALL:

(a) ENSURE THAT EACH PERSON PROCESSING THE PERSONAL DATA IS SUBJECT TO A DUTY OF CONFIDENTIALITY WITH RESPECT TO THE DATA; AND

(b) ENGAGE A SUBCONTRACTOR ONLY AFTER PROVIDING THE

PAGE 15-SENATE BILL 21-190
---
CONTROLLER WITH AN OPPORTUNITY TO OBJECT AND PURSUANT TO A WRITTEN CONTRACT IN ACCORDANCE WITH SUBSECTION (5) OF THIS SECTION THAT REQUIRES THE SUBCONTRACTOR TO MEET THE OBLIGATIONS OF THE PROCESSOR WITH RESPECT TO THE PERSONAL DATA.

(4) TAKING INTO ACCOUNT THE CONTEXT OF PROCESSING, THE CONTROLLER AND THE PROCESSOR SHALL IMPLEMENT APPROPRIATE TECHNICAL AND ORGANIZATIONAL MEASURES TO ENSURE A LEVEL OF SECURITY APPROPRIATE TO THE RISK AND ESTABLISH A CLEAR ALLOCATION OF THE RESPONSIBILITIES BETWEEN THEM TO IMPLEMENT THE MEASURES.

(5) PROCESSING BY A PROCESSOR MUST BE GOVERNED BY A CONTRACT BETWEEN THE CONTROLLER AND THE PROCESSOR THAT IS BINDING ON BOTH PARTIES AND THAT SETS OUT:

(a) THE PROCESSING INSTRUCTIONS TO WHICH THE PROCESSOR IS BOUND, INCLUDING THE NATURE AND PURPOSE OF THE PROCESSING;

(b) THE TYPE OF PERSONAL DATA SUBJECT TO THE PROCESSING, AND THE DURATION OF THE PROCESSING;

(c) THE REQUIREMENTS IMPOSED BY THIS SUBSECTION (5) AND SUBSECTIONS (3) AND (4) OF THIS SECTION; AND

(d) THE FOLLOWING REQUIREMENTS:

(I) AT THE CHOICE OF THE CONTROLLER, THE PROCESSOR SHALL DELETE OR RETURN ALL PERSONAL DATA TO THE CONTROLLER AS REQUESTED AT THE END OF THE PROVISION OF SERVICES, UNLESS RETENTION OF THE PERSONAL DATA IS REQUIRED BY LAW;

(II) (A) THE PROCESSOR SHALL MAKE AVAILABLE TO THE CONTROLLER ALL INFORMATION NECESSARY TO DEMONSTRATE COMPLIANCE WITH THE OBLIGATIONS IN THIS PART 13; AND

(B) THE PROCESSOR SHALL ALLOW FOR, AND CONTRIBUTE TO, REASONABLE AUDITS AND INSPECTIONS BY THE CONTROLLER OR THE CONTROLLER'S DESIGNATED AUDITOR. ALTERNATIVELY, THE PROCESSOR MAY, WITH THE CONTROLLER'S CONSENT, ARRANGE FOR A QUALIFIED AND INDEPENDENT AUDITOR TO CONDUCT, AT LEAST ANNUALLY AND AT THE

PAGE 16-SENATE BILL 21-190
---
# Processor's Expense

An audit of the processor's policies and technical and organizational measures in support of the obligations under this part 13 using an appropriate and accepted control standard or framework and audit procedure for the audits as applicable. The processor shall provide a report of the audit to the controller upon request.

## (6)

In no event may a contract relieve a controller or a processor from the liabilities imposed on them by virtue of its role in the processing relationship as defined by this part 13.

## (7)

Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determination that depends upon the context in which personal data are to be processed. A person that is not limited in its processing of personal data pursuant to a controller's instructions, or that fails to adhere to the instructions, is a controller and not a processor with respect to a specific processing of personal data. A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor. If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, it is a controller with respect to the processing.

## (8)

### (a)

A controller or processor that discloses personal data to another controller or processor in compliance with this part 13 does not violate this part 13 if the recipient processes the personal data in violation of this part 13, and, at the time of disclosing the personal data, the disclosing controller or processor did not have actual knowledge that the recipient intended to commit a violation.

### (b)

A controller or processor receiving personal data from a controller or processor in compliance with this part 13 as specified in subsection (8)(a) of this section does not violate this part 13 if the controller or processor from which it receives the personal data fails to comply with applicable obligations under this part 13.

---

PAGE 17-SENATE BILL 21-190
---

# 6-1-1306. Consumer personal data rights - repeal.

(1) CONSUMERS MAY EXERCISE THE FOLLOWING RIGHTS BY SUBMITTING A REQUEST USING THE METHODS SPECIFIED BY THE CONTROLLER IN THE PRIVACY NOTICE REQUIRED UNDER SECTION 6-1-1308 (1)(a). THE METHOD MUST TAKE INTO ACCOUNT THE WAYS IN WHICH CONSUMERS NORMALLY INTERACT WITH THE CONTROLLER, THE NEED FOR SECURE AND RELIABLE COMMUNICATION RELATING TO THE REQUEST, AND THE ABILITY OF THE CONTROLLER TO AUTHENTICATE THE IDENTITY OF THE CONSUMER MAKING THE REQUEST. CONTROLLERS SHALL NOT REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO EXERCISE CONSUMER RIGHTS PURSUANT TO THIS SECTION BUT MAY REQUIRE A CONSUMER TO USE AN EXISTING ACCOUNT. A CONSUMER MAY SUBMIT A REQUEST AT ANY TIME TO A CONTROLLER SPECIFYING WHICH OF THE FOLLOWING RIGHTS THE CONSUMER WISHES TO EXERCISE:

## (a) Right to opt out.
(I) A CONSUMER HAS THE RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF:

- (A) TARGETED ADVERTISING;
- (B) THE SALE OF PERSONAL DATA; OR
- (C) PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING A CONSUMER.

(II) A CONSUMER MAY AUTHORIZE ANOTHER PERSON, ACTING ON THE CONSUMER'S BEHALF, TO OPT OUT OF THE PROCESSING OF THE CONSUMER'S PERSONAL DATA FOR ONE OR MORE OF THE PURPOSES SPECIFIED IN SUBSECTION (1)(a)(I) OF THIS SECTION, INCLUDING THROUGH A TECHNOLOGY INDICATING THE CONSUMER'S INTENT TO OPT OUT SUCH AS A WEB LINK INDICATING A PREFERENCE OR BROWSER SETTING, BROWSER EXTENSION, OR GLOBAL DEVICE SETTING. A CONTROLLER SHALL COMPLY WITH AN OPT-OUT REQUEST RECEIVED FROM A PERSON AUTHORIZED BY THE CONSUMER TO ACT ON THE CONSUMER'S BEHALF IF THE CONTROLLER IS ABLE TO AUTHENTICATE, WITH COMMERCIALLY REASONABLE EFFORT, THE IDENTITY OF THE CONSUMER AND THE AUTHORIZED AGENT'S AUTHORITY TO ACT ON THE CONSUMER'S BEHALF.

(III) A CONTROLLER THAT PROCESSES PERSONAL DATA FOR

---
PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA SHALL PROVIDE A CLEAR AND CONSPICUOUS METHOD TO EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER PURSUANT TO SUBSECTION (1)(a)(I) OF THIS SECTION. THE CONTROLLER SHALL PROVIDE THE OPT-OUT METHOD CLEARLY AND CONSPICUOUSLY IN ANY PRIVACY NOTICE REQUIRED TO BE PROVIDED TO CONSUMERS UNDER THIS PART 13, AND IN A CLEAR, CONSPICUOUS, AND READILY ACCESSIBLE LOCATION OUTSIDE THE PRIVACY NOTICE.

(IV) (A) A CONTROLLER THAT PROCESSES PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA MAY ALLOW CONSUMERS TO EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO SUBSECTIONS (1)(a)(I)(A) AND (1)(a)(I)(B) OF THIS SECTION BY CONTROLLERS THROUGH A USER-SELECTED UNIVERSAL OPT-OUT MECHANISM THAT MEETS THE TECHNICAL SPECIFICATIONS ESTABLISHED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1313. THIS SUBSECTION (1)(a)(IV)(A) IS REPEALED, EFFECTIVE JULY 1, 2024.

(B) EFFECTIVE JULY 1, 2024, A CONTROLLER THAT PROCESSES PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA SHALL ALLOW CONSUMERS TO EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO SUBSECTIONS (1)(a)(I)(A) AND (1)(a)(I)(B) OF THIS SECTION BY CONTROLLERS THROUGH A USER-SELECTED UNIVERSAL OPT-OUT MECHANISM THAT MEETS THE TECHNICAL SPECIFICATIONS ESTABLISHED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1313.

(C) NOTWITHSTANDING A CONSUMER'S DECISION TO EXERCISE THE RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA THROUGH A UNIVERSAL OPT-OUT MECHANISM PURSUANT TO SUBSECTION (1)(a)(IV)(B) OF THIS SECTION, A CONTROLLER MAY ENABLE THE CONSUMER TO CONSENT, THROUGH A WEB PAGE, APPLICATION, OR A SIMILAR METHOD, TO THE PROCESSING OF THE CONSUMER'S PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA, AND THE CONSENT TAKES PRECEDENCE OVER ANY CHOICE REFLECTED THROUGH THE UNIVERSAL OPT-OUT MECHANISM. BEFORE OBTAINING A CONSUMER'S CONSENT TO PROCESS PERSONAL DATA FOR PURPOSES OF TARGETED

PAGE 19-SENATE BILL 21-190
---
ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO THIS SUBSECTION (1)(a)(IV)(C), A CONTROLLER SHALL PROVIDE THE CONSUMER WITH A CLEAR AND CONSPICUOUS NOTICE INFORMING THE CONSUMER ABOUT THE CHOICES AVAILABLE UNDER THIS SECTION, DESCRIBING THE CATEGORIES OF PERSONAL DATA TO BE PROCESSED AND THE PURPOSES FOR WHICH THEY WILL BE PROCESSED, AND EXPLAINING HOW AND WHERE THE CONSUMER MAY WITHDRAW CONSENT. THE WEB PAGE, APPLICATION, OR OTHER MEANS BY WHICH A CONTROLLER OBTAINS A CONSUMER'S CONSENT TO PROCESS PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA MUST ALSO ALLOW THE CONSUMER TO REVOKE THE CONSENT AS EASILY AS IT IS AFFIRMATIVELY PROVIDED.

### (b) Right of access.
A CONSUMER HAS THE RIGHT TO CONFIRM WHETHER A CONTROLLER IS PROCESSING PERSONAL DATA CONCERNING THE CONSUMER AND TO ACCESS THE CONSUMER'S PERSONAL DATA.

### (c) Right to correction.
A CONSUMER HAS THE RIGHT TO CORRECT INACCURACIES IN THE CONSUMER'S PERSONAL DATA, TAKING INTO ACCOUNT THE NATURE OF THE PERSONAL DATA AND THE PURPOSES OF THE PROCESSING OF THE CONSUMER'S PERSONAL DATA.

### (d) Right to deletion.
A CONSUMER HAS THE RIGHT TO DELETE PERSONAL DATA CONCERNING THE CONSUMER.

### (e) Right to data portability.
WHEN EXERCISING THE RIGHT TO ACCESS PERSONAL DATA PURSUANT TO SUBSECTION (1)(b) OF THIS SECTION, A CONSUMER HAS THE RIGHT TO OBTAIN THE PERSONAL DATA IN A PORTABLE AND, TO THE EXTENT TECHNICALLY FEASIBLE, READILY USABLE FORMAT THAT ALLOWS THE CONSUMER TO TRANSMIT THE DATA TO ANOTHER ENTITY WITHOUT HINDRANCE. A CONSUMER MAY EXERCISE THIS RIGHT NO MORE THAN TWO TIMES PER CALENDAR YEAR. NOTHING IN THIS SUBSECTION (1)(e) REQUIRES A CONTROLLER TO PROVIDE THE DATA TO THE CONSUMER IN A MANNER THAT WOULD DISCLOSE THE CONTROLLER'S TRADE SECRETS.

### (2) Responding to consumer requests.
#### (a)
A CONTROLLER SHALL INFORM A CONSUMER OF ANY ACTION TAKEN ON A REQUEST UNDER SUBSECTION (1) OF THIS SECTION WITHOUT UNDUE DELAY AND, IN ANY EVENT, WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF THE REQUEST. THE CONTROLLER MAY EXTEND THE FORTY-FIVE-DAY PERIOD BY FORTY-FIVE ADDITIONAL DAYS WHERE REASONABLY NECESSARY, TAKING INTO ACCOUNT

PAGE 20-SENATE BILL 21-190
---
THE COMPLEXITY AND NUMBER OF THE REQUESTS. THE CONTROLLER SHALL INFORM THE CONSUMER OF AN EXTENSION WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF THE REQUEST, TOGETHER WITH THE REASONS FOR THE DELAY.

(b) IF A CONTROLLER DOES NOT TAKE ACTION ON THE REQUEST OF A CONSUMER, THE CONTROLLER SHALL INFORM THE CONSUMER, WITHOUT UNDUE DELAY AND, AT THE LATEST, WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF THE REQUEST, OF THE REASONS FOR NOT TAKING ACTION AND INSTRUCTIONS FOR HOW TO APPEAL THE DECISION WITH THE CONTROLLER AS DESCRIBED IN SUBSECTION (3) OF THIS SECTION.

(c) UPON REQUEST, A CONTROLLER SHALL PROVIDE TO THE CONSUMER THE INFORMATION SPECIFIED IN THIS SECTION FREE OF CHARGE; EXCEPT THAT, FOR A SECOND OR SUBSEQUENT REQUEST WITHIN A TWELVE-MONTH PERIOD, THE CONTROLLER MAY CHARGE AN AMOUNT CALCULATED IN THE MANNER SPECIFIED IN SECTION 24-72-205 (5)(a).

(d) A CONTROLLER IS NOT REQUIRED TO COMPLY WITH A REQUEST TO EXERCISE ANY OF THE RIGHTS UNDER SUBSECTION (1) OF THIS SECTION IF THE CONTROLLER IS UNABLE TO AUTHENTICATE THE REQUEST USING COMMERCIALLY REASONABLE EFFORTS, IN WHICH CASE THE CONTROLLER MAY REQUEST THE PROVISION OF ADDITIONAL INFORMATION REASONABLY NECESSARY TO AUTHENTICATE THE REQUEST.

(3) (a) A CONTROLLER SHALL ESTABLISH AN INTERNAL PROCESS WHEREBY CONSUMERS MAY APPEAL A REFUSAL TO TAKE ACTION ON A REQUEST TO EXERCISE ANY OF THE RIGHTS UNDER SUBSECTION (1) OF THIS SECTION WITHIN A REASONABLE PERIOD AFTER THE CONSUMER'S RECEIPT OF THE NOTICE SENT BY THE CONTROLLER UNDER SUBSECTION (2)(b) OF THIS SECTION. THE APPEAL PROCESS MUST BE CONSPICUOUSLY AVAILABLE AND AS EASY TO USE AS THE PROCESS FOR SUBMITTING A REQUEST UNDER THIS SECTION.

(b) WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF AN APPEAL, A CONTROLLER SHALL INFORM THE CONSUMER OF ANY ACTION TAKEN OR NOT TAKEN IN RESPONSE TO THE APPEAL, ALONG WITH A WRITTEN EXPLANATION OF THE REASONS IN SUPPORT OF THE RESPONSE. THE CONTROLLER MAY EXTEND THE FORTY-FIVE-DAY PERIOD BY SIXTY ADDITIONAL DAYS WHERE REASONABLY NECESSARY, TAKING INTO ACCOUNT THE COMPLEXITY AND NUMBER OF REQUESTS SERVING AS THE BASIS FOR THE APPEAL. THE

PAGE 21-SENATE BILL 21-190
---
CONTROLLER SHALL INFORM THE CONSUMER OF AN EXTENSION WITHIN FORTY-FIVE DAYS AFTER RECEIPT OF THE APPEAL, TOGETHER WITH THE REASONS FOR THE DELAY.

(c) THE CONTROLLER SHALL INFORM THE CONSUMER OF THE CONSUMER'S ABILITY TO CONTACT THE ATTORNEY GENERAL IF THE CONSUMER HAS CONCERNS ABOUT THE RESULT OF THE APPEAL.

## 6-1-1307. Processing de-identified data.
(1) THIS PART 13 DOES NOT REQUIRE A CONTROLLER OR PROCESSOR TO DO ANY OF THE FOLLOWING SOLELY FOR PURPOSES OF COMPLYING WITH THIS PART 13:

(a) REIDENTIFY DE-IDENTIFIED DATA;

(b) COMPLY WITH AN AUTHENTICATED CONSUMER REQUEST TO ACCESS, CORRECT, DELETE, OR PROVIDE PERSONAL DATA IN A PORTABLE FORMAT PURSUANT TO SECTION 6-1-1306 (1), IF ALL OF THE FOLLOWING ARE TRUE:

(I) (A) THE CONTROLLER IS NOT REASONABLY CAPABLE OF ASSOCIATING THE REQUEST WITH THE PERSONAL DATA; OR

(B) IT WOULD BE UNREASONABLY BURDENSOME FOR THE CONTROLLER TO ASSOCIATE THE REQUEST WITH THE PERSONAL DATA;

(II) THE CONTROLLER DOES NOT USE THE PERSONAL DATA TO RECOGNIZE OR RESPOND TO THE SPECIFIC CONSUMER WHO IS THE SUBJECT OF THE PERSONAL DATA OR ASSOCIATE THE PERSONAL DATA WITH OTHER PERSONAL DATA ABOUT THE SAME SPECIFIC CONSUMER; AND

(III) THE CONTROLLER DOES NOT SELL THE PERSONAL DATA TO ANY THIRD PARTY OR OTHERWISE VOLUNTARILY DISCLOSE THE PERSONAL DATA TO ANY THIRD PARTY, EXCEPT AS OTHERWISE AUTHORIZED BY THE CONSUMER; OR

(c) MAINTAIN DATA IN IDENTIFIABLE FORM OR COLLECT, OBTAIN, RETAIN, OR ACCESS ANY DATA OR TECHNOLOGY IN ORDER TO ENABLE THE CONTROLLER TO ASSOCIATE AN AUTHENTICATED CONSUMER REQUEST WITH PERSONAL DATA.

PAGE 22-SENATE BILL 21-190
---
(2) A CONTROLLER THAT USES DE-IDENTIFIED DATA SHALL EXERCISE REASONABLE OVERSIGHT TO MONITOR COMPLIANCE WITH ANY CONTRACTUAL COMMITMENTS TO WHICH THE DE-IDENTIFIED DATA ARE SUBJECT AND SHALL TAKE APPROPRIATE STEPS TO ADDRESS ANY BREACHES OF CONTRACTUAL COMMITMENTS.

(3) THE RIGHTS CONTAINED IN SECTION 6-1-1306 (1)(b) TO (1)(e) DO NOT APPLY TO PSEUDONYMOUS DATA IF THE CONTROLLER CAN DEMONSTRATE THAT THE INFORMATION NECESSARY TO IDENTIFY THE CONSUMER IS KEPT SEPARATELY AND IS SUBJECT TO EFFECTIVE TECHNICAL AND ORGANIZATIONAL CONTROLS THAT PREVENT THE CONTROLLER FROM ACCESSING THE INFORMATION.

## 6-1-1308. Duties of controllers.
(1) **Duty of transparency.**
(a) A CONTROLLER SHALL PROVIDE CONSUMERS WITH A REASONABLY ACCESSIBLE, CLEAR, AND MEANINGFUL PRIVACY NOTICE THAT INCLUDES:

(I) THE CATEGORIES OF PERSONAL DATA COLLECTED OR PROCESSED BY THE CONTROLLER OR A PROCESSOR;

(II) THE PURPOSES FOR WHICH THE CATEGORIES OF PERSONAL DATA ARE PROCESSED;

(III) HOW AND WHERE CONSUMERS MAY EXERCISE THE RIGHTS PURSUANT TO SECTION 6-1-1306, INCLUDING THE CONTROLLER'S CONTACT INFORMATION AND HOW A CONSUMER MAY APPEAL A CONTROLLER'S ACTION WITH REGARD TO THE CONSUMER'S REQUEST;

(IV) THE CATEGORIES OF PERSONAL DATA THAT THE CONTROLLER SHARES WITH THIRD PARTIES, IF ANY; AND

(V) THE CATEGORIES OF THIRD PARTIES, IF ANY, WITH WHOM THE CONTROLLER SHARES PERSONAL DATA.

(b) IF A CONTROLLER SELLS PERSONAL DATA TO THIRD PARTIES OR PROCESSES PERSONAL DATA FOR TARGETED ADVERTISING, THE CONTROLLER SHALL CLEARLY AND CONSPICUOUSLY DISCLOSE THE SALE OR PROCESSING, AS WELL AS THE MANNER IN WHICH A CONSUMER MAY EXERCISE THE RIGHT TO OPT OUT OF THE SALE OR PROCESSING.

PAGE 23-SENATE BILL 21-190
---
(c) A CONTROLLER SHALL NOT:

   (I) REQUIRE A CONSUMER TO CREATE A NEW ACCOUNT IN ORDER TO EXERCISE A RIGHT; OR

   (II) BASED SOLELY ON THE EXERCISE OF A RIGHT AND UNRELATED TO FEASIBILITY OR THE VALUE OF A SERVICE, INCREASE THE COST OF, OR DECREASE THE AVAILABILITY OF, THE PRODUCT OR SERVICE.

(d) NOTHING IN THIS PART 13 SHALL BE CONSTRUED TO REQUIRE A CONTROLLER TO PROVIDE A PRODUCT OR SERVICE THAT REQUIRES THE PERSONAL DATA OF A CONSUMER THAT THE CONTROLLER DOES NOT COLLECT OR MAINTAIN OR TO PROHIBIT A CONTROLLER FROM OFFERING A DIFFERENT PRICE, RATE, LEVEL, QUALITY, OR SELECTION OF GOODS OR SERVICES TO A CONSUMER, INCLUDING OFFERING GOODS OR SERVICES FOR NO FEE, IF THE OFFER IS RELATED TO A CONSUMER'S VOLUNTARY PARTICIPATION IN A BONA FIDE LOYALTY, REWARDS, PREMIUM FEATURES, DISCOUNT, OR CLUB CARD PROGRAM.

(2) Duty of purpose specification. A CONTROLLER SHALL SPECIFY THE EXPRESS PURPOSES FOR WHICH PERSONAL DATA ARE COLLECTED AND PROCESSED.

(3) Duty of data minimization. A CONTROLLER'S COLLECTION OF PERSONAL DATA MUST BE ADEQUATE, RELEVANT, AND LIMITED TO WHAT IS REASONABLY NECESSARY IN RELATION TO THE SPECIFIED PURPOSES FOR WHICH THE DATA ARE PROCESSED.

(4) Duty to avoid secondary use. A CONTROLLER SHALL NOT PROCESS PERSONAL DATA FOR PURPOSES THAT ARE NOT REASONABLY NECESSARY TO OR COMPATIBLE WITH THE SPECIFIED PURPOSES FOR WHICH THE PERSONAL DATA ARE PROCESSED, UNLESS THE CONTROLLER FIRST OBTAINS THE CONSUMER'S CONSENT.

(5) Duty of care. A CONTROLLER SHALL TAKE REASONABLE MEASURES TO SECURE PERSONAL DATA DURING BOTH STORAGE AND USE FROM UNAUTHORIZED ACQUISITION. THE DATA SECURITY PRACTICES MUST BE APPROPRIATE TO THE VOLUME, SCOPE, AND NATURE OF THE PERSONAL DATA PROCESSED AND THE NATURE OF THE BUSINESS.

PAGE 24-SENATE BILL 21-190
---
```
(6) Duty to avoid unlawful discrimination. A CONTROLLER SHALL NOT PROCESS PERSONAL DATA IN VIOLATION OF STATE OR FEDERAL LAWS THAT PROHIBIT UNLAWFUL DISCRIMINATION AGAINST CONSUMERS.

(7) Duty regarding sensitive data. A CONTROLLER SHALL NOT PROCESS A CONSUMER'S SENSITIVE DATA WITHOUT FIRST OBTAINING THE CONSUMER'S CONSENT OR, IN THE CASE OF THE PROCESSING OF PERSONAL DATA CONCERNING A KNOWN CHILD, WITHOUT FIRST OBTAINING CONSENT FROM THE CHILD'S PARENT OR LAWFUL GUARDIAN.

6-1-1309. Data protection assessments - attorney general access and evaluation - definition. (1) A CONTROLLER SHALL NOT CONDUCT PROCESSING THAT PRESENTS A HEIGHTENED RISK OF HARM TO A CONSUMER WITHOUT CONDUCTING AND DOCUMENTING A DATA PROTECTION ASSESSMENT OF EACH OF ITS PROCESSING ACTIVITIES THAT INVOLVE PERSONAL DATA ACQUIRED ON OR AFTER THE EFFECTIVE DATE OF THIS SECTION THAT PRESENT A HEIGHTENED RISK OF HARM TO A CONSUMER.

(2) FOR PURPOSES OF THIS SECTION, "PROCESSING THAT PRESENTS A HEIGHTENED RISK OF HARM TO A CONSUMER" INCLUDES THE FOLLOWING:

(a) PROCESSING PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR FOR PROFILING IF THE PROFILING PRESENTS A REASONABLY FORESEEABLE RISK OF:

(I) UNFAIR OR DECEPTIVE TREATMENT OF, OR UNLAWFUL DISPARATE IMPACT ON, CONSUMERS;

(II) FINANCIAL OR PHYSICAL INJURY TO CONSUMERS;

(III) A PHYSICAL OR OTHER INTRUSION UPON THE SOLITUDE OR SECLUSION, OR THE PRIVATE AFFAIRS OR CONCERNS, OF CONSUMERS IF THE INTRUSION WOULD BE OFFENSIVE TO A REASONABLE PERSON; OR

(IV) OTHER SUBSTANTIAL INJURY TO CONSUMERS;

(b) SELLING PERSONAL DATA; AND

(c) PROCESSING SENSITIVE DATA.
```

---

(3) Data protection assessments must identify and weigh the benefits that may flow, directly and indirectly, from the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to the rights of the consumer associated with the processing, as mitigated by safeguards that the controller can employ to reduce the risks. The controller shall factor into this assessment the use of de-identified data and the reasonable expectations of consumers, as well as the context of the processing and the relationship between the controller and the consumer whose personal data will be processed.

(4) A controller shall make the data protection assessment available to the attorney general upon request. The attorney general may evaluate the data protection assessment for compliance with the duties contained in section 6-1-1308 and with other laws, including this article 1. Data protection assessments are confidential and exempt from public inspection and copying under the "Colorado Open Records Act", part 2 of article 72 of title 24. The disclosure of a data protection assessment pursuant to a request from the attorney general under this subsection (4) does not constitute a waiver of any attorney-client privilege or work-product protection that might otherwise exist with respect to the assessment and any information contained in the assessment.

(5) A single data protection assessment may address a comparable set of processing operations that include similar activities.

(6) Data protection assessment requirements apply to processing activities created or generated after July 1, 2023, and are not retroactive.

### 6-1-1310. Liability.
(1) Notwithstanding any provision in part 1 of this article 1, this part 13 does not authorize a private right of action for a violation of this part 13 or any other provision of law. This subsection (1) neither relieves any party from any duties or obligations imposed, nor alters any independent rights that consumers have, under other laws, including this article 1, the

---
STATE CONSTITUTION, OR THE UNITED STATES CONSTITUTION.

(2) WHERE MORE THAN ONE CONTROLLER OR PROCESSOR, OR BOTH A CONTROLLER AND A PROCESSOR, INVOLVED IN THE SAME PROCESSING VIOLATES THIS PART 13, THE LIABILITY SHALL BE ALLOCATED AMONG THE PARTIES ACCORDING TO PRINCIPLES OF COMPARATIVE FAULT.

### 6-1-1311. Enforcement - penalties - repeal.
(1)(a) NOTWITHSTANDING ANY OTHER PROVISION OF THIS ARTICLE 1, THE ATTORNEY GENERAL AND DISTRICT ATTORNEYS HAVE EXCLUSIVE AUTHORITY TO ENFORCE THIS PART 13 BY BRINGING AN ACTION IN THE NAME OF THE STATE OR AS PARENS PATRIAE ON BEHALF OF PERSONS RESIDING IN THE STATE TO ENFORCE THIS PART 13 AS PROVIDED IN THIS ARTICLE 1, INCLUDING SEEKING AN INJUNCTION TO ENJOIN A VIOLATION OF THIS PART 13.

(b) NOTWITHSTANDING ANY OTHER PROVISION OF THIS ARTICLE 1, NOTHING IN THIS PART 13 SHALL BE CONSTRUED AS PROVIDING THE BASIS FOR, OR BEING SUBJECT TO, A PRIVATE RIGHT OF ACTION FOR VIOLATIONS OF THIS PART 13 OR ANY OTHER LAW.

(c) FOR PURPOSES ONLY OF ENFORCEMENT OF THIS PART 13 BY THE ATTORNEY GENERAL OR A DISTRICT ATTORNEY, A VIOLATION OF THIS PART 13 IS A DECEPTIVE TRADE PRACTICE.

(d) PRIOR TO ANY ENFORCEMENT ACTION PURSUANT TO SUBSECTION (1)(a) OF THIS SECTION, THE ATTORNEY GENERAL OR DISTRICT ATTORNEY MUST ISSUE A NOTICE OF VIOLATION TO THE CONTROLLER IF A CURE IS DEEMED POSSIBLE. IF THE CONTROLLER FAILS TO CURE THE VIOLATION WITHIN SIXTY DAYS AFTER RECEIPT OF THE NOTICE OF VIOLATION, AN ACTION MAY BE BROUGHT PURSUANT TO THIS SECTION. THIS SUBSECTION (1)(d) IS REPEALED, EFFECTIVE JANUARY 1, 2025.

(2) THE STATE TREASURER SHALL CREDIT ALL RECEIPTS FROM THE IMPOSITION OF CIVIL PENALTIES UNDER THIS PART 13 PURSUANT TO SECTION 24-31-108.

### 6-1-1312. Preemption - local governments.
THIS PART 13 SUPERSEDES AND PREEMPTS LAWS, ORDINANCES, RESOLUTIONS, REGULATIONS, OR THE EQUIVALENT ADOPTED BY ANY STATUTORY OR HOME

PAGE 27-SENATE BILL 21-190
---
# 6-1-1313. Rules - opt-out mechanism.

(1) The Attorney General may promulgate rules for the purpose of carrying out this part 13.

(2) By July 1, 2023, the Attorney General shall adopt rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B). The Attorney General may update the rules that detail the technical specifications for the mechanisms from time to time to reflect the means by which consumers interact with controllers. The rules must:

(a) Not permit the manufacturer of a platform, browser, device, or any other product offering a universal opt-out mechanism to unfairly disadvantage another controller;

(b) Require controllers to inform consumers about the opt-out choices available under section 6-1-1306 (1)(a)(I);

(c) Not adopt a mechanism that is a default setting, but rather clearly represents the consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B);

(d) Adopt a mechanism that is consumer-friendly, clearly described, and easy to use by the average consumer;

(e) Adopt a mechanism that is as consistent as possible with any other similar mechanism required by law or regulation in the United States; and

(f) Permit the controller to accurately authenticate the consumer as a resident of this state and determine that the

---

PAGE 28-SENATE BILL 21-190
---
MECHANISM REPRESENTS A LEGITIMATE REQUEST TO OPT OUT OF THE PROCESSING OF PERSONAL DATA FOR PURPOSES OF TARGETED ADVERTISING OR THE SALE OF PERSONAL DATA PURSUANT TO SECTION 6-1-1306 (1)(a)(I)(A) OR (1)(a)(I)(B).

(3) BY JANUARY 1, 2025, THE ATTORNEY GENERAL MAY ADOPT RULES THAT GOVERN THE PROCESS OF ISSUING OPINION LETTERS AND INTERPRETIVE GUIDANCE TO DEVELOP AN OPERATIONAL FRAMEWORK FOR BUSINESS THAT INCLUDES A GOOD FAITH RELIANCE DEFENSE OF AN ACTION THAT MAY OTHERWISE CONSTITUTE A VIOLATION OF THIS PART 13. THE RULES MUST BECOME EFFECTIVE BY JULY 1, 2025.

## SECTION 2.
In Colorado Revised Statutes, amend 6-1-104 as follows:

### 6-1-104. Cooperative reporting.
The district attorneys may cooperate in a statewide reporting system by receiving, on forms provided by the attorney general, complaints from persons concerning deceptive trade practices listed in section 6-1-105 and part 7 OR 13 of this ARTICLE 1 and transmitting the complaints to the attorney general.

## SECTION 3.
In Colorado Revised Statutes, 6-1-105, add (1)(nnn) as follows:

### 6-1-105. Unfair or deceptive trade practices.
(1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person:

(nnn) VIOLATES ANY PROVISION OF PART 13 OF THIS ARTICLE 1 AS SPECIFIED IN SECTION 6-1-1311 (1)(c).

## SECTION 4.
In Colorado Revised Statutes, 6-1-107, amend (1) introductory portion as follows:

### 6-1-107. Powers of attorney general and district attorneys.
(1) When the attorney general or a district attorney has reasonable cause to believe that any person, whether in this state or elsewhere, has engaged in or is engaging in any deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of this ARTICLE 1, the attorney general or district attorney may:

PAGE 29-SENATE BILL 21-190
---
# SECTION 5.
In Colorado Revised Statutes, 6-1-108, amend (1) as follows:

## 6-1-108. Subpoenas - hearings - rules.
(1) When the attorney general or a district attorney has reasonable cause to believe that a person, whether in this state or elsewhere, has engaged in or is engaging in a deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of this article 1, the attorney general or a district attorney, in addition to other powers conferred upon him or her THE ATTORNEY GENERAL OR A DISTRICT ATTORNEY by this article 1, may issue subpoenas to require the attendance of witnesses or the production of documents, administer oaths, conduct hearings in aid of any investigation or inquiry, and prescribe such forms and promulgate such rules as may be necessary to administer the provisions of this article 1.

# SECTION 6.
In Colorado Revised Statutes, 6-1-110, amend (1) and (2) as follows:

## 6-1-110. Restraining orders - injunctions - assurances of discontinuance.
(1) Whenever the attorney general or a district attorney has cause to believe that a person has engaged in or is engaging in any deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of this article ARTICLE 1, the attorney general or district attorney may apply for and obtain, in an action in the appropriate district court of this state, a temporary restraining order or injunction, or both, pursuant to the Colorado rules of civil procedure, prohibiting such THE person from continuing such THE practices, or engaging therein, or doing any act in furtherance thereof. The court may make such orders or judgments as may be necessary to prevent the use or employment by such THE person of any such deceptive trade practice or which THAT may be necessary to completely compensate or restore to the original position of any person injured by means of any such practice or to prevent any unjust enrichment by any person through the use or employment of any deceptive trade practice.

(2) Where the attorney general or a district attorney has authority to institute a civil action or other proceeding pursuant to the provisions of this article ARTICLE 1, the attorney general or district attorney may accept, in lieu thereof or as a part thereof, an assurance of discontinuance of any deceptive trade practice listed in section 6-1-105 or part 7 OR 13 of this article. Such ARTICLE 1. THE assurance may include a stipulation for the voluntary
---
payment by the alleged violator of the costs of investigation and any action or proceeding by the attorney general or a district attorney and any amount necessary to restore to any person any money or property that may have been acquired by such THE alleged violator by means of any such deceptive trade practice. Any such assurance of discontinuance accepted by the attorney general or a district attorney and any such stipulation filed with the court as a part of any such action or proceeding shall be IS a matter of public record unless the attorney general or the district attorney determines, at his or her THE discretion OF THE ATTORNEY GENERAL OR DISTRICT ATTORNEY, that it will be confidential to the parties to the action or proceeding and to the court and its employees. Upon the filing of a civil action by the attorney general or a district attorney alleging that a confidential assurance of discontinuance or stipulation accepted pursuant to this subsection (2) has been violated, said THE assurance of discontinuance or stipulation shall thereupon be deemed BECOMES a public record and open to inspection by any person. Proof by a preponderance of the evidence of a violation of any such assurance or stipulation shall constitute CONSTITUTES prima facie evidence of a deceptive trade practice for the purposes of any civil action or proceeding brought thereafter by the attorney general or a district attorney, whether a new action or a subsequent motion or petition in any pending action or proceeding.

#### SECTION 7. Act subject to petition - effective date - applicability.
(1) This act takes effect July 1, 2023; except that, if a referendum petition is filed pursuant to section 1 (3) of article V of the state constitution against this act or an item, section, or part of this act within the ninety-day period after final adjournment of the general assembly, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2022 and, in such case, will take effect July 1, 2023, or on the date of the official declaration of the vote thereon by the governor, whichever is later.
---
(2) This act applies to conduct occurring on or after the applicable effective date of this act.

| Leroy M. Garcia | Alec Garnett |
|-----------------|--------------|
| PRESIDENT OF THE SENATE | SPEAKER OF THE HOUSE OF REPRESENTATIVES |

| Cindi L. Markwell | Robin Jones |
|-------------------|--------------|
| SECRETARY OF THE SENATE | CHIEF CLERK OF THE HOUSE OF REPRESENTATIVES |

APPROVED___________________________

(Date and Time)

___________________________
Jared S. Polis
GOVERNOR OF THE STATE OF COLORADO


# SENATE BILL 24-205

BY SENATOR(S) Rodriguez, Cutter, Michaelson Jenet, Priola, Winter F., Fenberg;
also REPRESENTATIVE(S) Titone and Rutinel, Duran.

CONCERNING CONSUMER PROTECTIONS IN INTERACTIONS WITH ARTIFICIAL INTELLIGENCE SYSTEMS.

Be it enacted by the General Assembly of the State of Colorado:

## SECTION 1.
In Colorado Revised Statutes, add part 17 to article 1 of title 6 as follows:

### PART 17
### ARTIFICIAL INTELLIGENCE

#### 6-1-1701. Definitions.
AS USED IN THIS PART 17, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(1) (a) "ALGORITHMIC DISCRIMINATION" MEANS ANY CONDITION IN WHICH THE USE OF AN ARTIFICIAL INTELLIGENCE SYSTEM RESULTS IN AN UNLAWFUL DIFFERENTIAL TREATMENT OR IMPACT THAT DISFAVORS AN INDIVIDUAL OR GROUP OF INDIVIDUALS ON THE BASIS OF THEIR ACTUAL OR
---
PERCEIVED AGE, COLOR, DISABILITY, ETHNICITY, GENETIC INFORMATION, LIMITED PROFICIENCY IN THE ENGLISH LANGUAGE, NATIONAL ORIGIN, RACE, RELIGION, REPRODUCTIVE HEALTH, SEX, VETERAN STATUS, OR OTHER CLASSIFICATION PROTECTED UNDER THE LAWS OF THIS STATE OR FEDERAL LAW.

(b) "ALGORITHMIC DISCRIMINATION" DOES NOT INCLUDE:

(I) THE OFFER, LICENSE, OR USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM BY A DEVELOPER OR DEPLOYER FOR THE SOLE PURPOSE OF:

(A) THE DEVELOPER'S OR DEPLOYER'S SELF-TESTING TO IDENTIFY, MITIGATE, OR PREVENT DISCRIMINATION OR OTHERWISE ENSURE COMPLIANCE WITH STATE AND FEDERAL LAW; OR

(B) EXPANDING AN APPLICANT, CUSTOMER, OR PARTICIPANT POOL TO INCREASE DIVERSITY OR REDRESS HISTORICAL DISCRIMINATION; OR

(II) AN ACT OR OMISSION BY OR ON BEHALF OF A PRIVATE CLUB OR OTHER ESTABLISHMENT THAT IS NOT IN FACT OPEN TO THE PUBLIC, AS SET FORTH IN TITLE II OF THE FEDERAL "CIVIL RIGHTS ACT OF 1964", 42 U.S.C. SEC. 2000a (e), AS AMENDED.

(2) "ARTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY MACHINE-BASED SYSTEM THAT, FOR ANY EXPLICIT OR IMPLICIT OBJECTIVE, INFERS FROM THE INPUTS THE SYSTEM RECEIVES HOW TO GENERATE OUTPUTS, INCLUDING CONTENT, DECISIONS, PREDICTIONS, OR RECOMMENDATIONS, THAT CAN INFLUENCE PHYSICAL OR VIRTUAL ENVIRONMENTS.

(3) "CONSEQUENTIAL DECISION" MEANS A DECISION THAT HAS A MATERIAL LEGAL OR SIMILARLY SIGNIFICANT EFFECT ON THE PROVISION OR DENIAL TO ANY CONSUMER OF, OR THE COST OR TERMS OF:

(a) EDUCATION ENROLLMENT OR AN EDUCATION OPPORTUNITY;

(b) EMPLOYMENT OR AN EMPLOYMENT OPPORTUNITY;

(c) A FINANCIAL OR LENDING SERVICE;

PAGE 2-SENATE BILL 24-205
---

(d) AN ESSENTIAL GOVERNMENT SERVICE;

(e) HEALTH-CARE SERVICES;

(f) HOUSING;

(g) INSURANCE; OR

(h) A LEGAL SERVICE.

(4) "CONSUMER" MEANS AN INDIVIDUAL WHO IS A COLORADO RESIDENT.

(5) "DEPLOY" MEANS TO USE A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(6) "DEPLOYER" MEANS A PERSON DOING BUSINESS IN THIS STATE THAT DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(7) "DEVELOPER" MEANS A PERSON DOING BUSINESS IN THIS STATE THAT DEVELOPS OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES AN ARTIFICIAL INTELLIGENCE SYSTEM.

(8) "HEALTH-CARE SERVICES" HAS THE SAME MEANING AS PROVIDED IN 42 U.S.C. SEC. 234 (d)(2).

(9) (a) "HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM" MEANS ANY ARTIFICIAL INTELLIGENCE SYSTEM THAT, WHEN DEPLOYED, MAKES, OR IS A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION.

(b) "HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM" DOES NOT INCLUDE:

(I) AN ARTIFICIAL INTELLIGENCE SYSTEM IF THE ARTIFICIAL INTELLIGENCE SYSTEM IS INTENDED TO:

(A) PERFORM A NARROW PROCEDURAL TASK; OR

(B) DETECT DECISION-MAKING PATTERNS OR DEVIATIONS FROM PRIOR DECISION-MAKING PATTERNS AND IS NOT INTENDED TO REPLACE OR

---
INFLUENCE A PREVIOUSLY COMPLETED HUMAN ASSESSMENT WITHOUT SUFFICIENT HUMAN REVIEW; OR

(II) THE FOLLOWING TECHNOLOGIES, UNLESS THE TECHNOLOGIES, WHEN DEPLOYED, MAKE, OR ARE A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION:

(A) ANTI-FRAUD TECHNOLOGY THAT DOES NOT USE FACIAL RECOGNITION TECHNOLOGY;

(B) ANTI-MALWARE;

(C) ANTI-VIRUS;

(D) ARTIFICIAL INTELLIGENCE-ENABLED VIDEO GAMES;

(E) CALCULATORS;

(F) CYBERSECURITY;

(G) DATABASES;

(H) DATA STORAGE;

(I) FIREWALL;

(J) INTERNET DOMAIN REGISTRATION;

(K) INTERNET WEBSITE LOADING;

(L) NETWORKING;

(M) SPAM- AND ROBOCALL-FILTERING;

(N) SPELL-CHECKING;

(O) SPREADSHEETS;

(P) WEB CACHING;

PAGE 4-SENATE BILL 24-205
---
(Q) WEB HOSTING OR ANY SIMILAR TECHNOLOGY; OR

(R) TECHNOLOGY THAT COMMUNICATES WITH CONSUMERS IN NATURAL LANGUAGE FOR THE PURPOSE OF PROVIDING USERS WITH INFORMATION, MAKING REFERRALS OR RECOMMENDATIONS, AND ANSWERING QUESTIONS AND IS SUBJECT TO AN ACCEPTED USE POLICY THAT PROHIBITS GENERATING CONTENT THAT IS DISCRIMINATORY OR HARMFUL.

(10) (a) "INTENTIONAL AND SUBSTANTIAL MODIFICATION" OR "INTENTIONALLY AND SUBSTANTIALLY MODIFIES" MEANS A DELIBERATE CHANGE MADE TO AN ARTIFICIAL INTELLIGENCE SYSTEM THAT RESULTS IN ANY NEW REASONABLY FORESEEABLE RISK OF ALGORITHMIC DISCRIMINATION.

(b) "INTENTIONAL AND SUBSTANTIAL MODIFICATION" OR "INTENTIONALLY AND SUBSTANTIALLY MODIFIES" DOES NOT INCLUDE A CHANGE MADE TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, OR THE PERFORMANCE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, IF:

(I) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTINUES TO LEARN AFTER THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS:

(A) OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR OTHERWISE MADE AVAILABLE TO A DEPLOYER; OR

(B) DEPLOYED;

(II) THE CHANGE IS MADE TO THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS A RESULT OF ANY LEARNING DESCRIBED IN SUBSECTION (10)(b)(I) OF THIS SECTION;

(III) THE CHANGE WAS PREDETERMINED BY THE DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, WHEN THE DEPLOYER OR THIRD PARTY COMPLETED AN INITIAL IMPACT ASSESSMENT OF SUCH HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PURSUANT TO SECTION 6-1-1703 (3); AND

(IV) THE CHANGE IS INCLUDED IN TECHNICAL DOCUMENTATION FOR THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

PAGE 5-SENATE BILL 24-205
---

(11) (a) "SUBSTANTIAL FACTOR" MEANS A FACTOR THAT:

(I) ASSISTS IN MAKING A CONSEQUENTIAL DECISION;

(II) IS CAPABLE OF ALTERING THE OUTCOME OF A CONSEQUENTIAL DECISION; AND

(III) IS GENERATED BY AN ARTIFICIAL INTELLIGENCE SYSTEM.

(b) "SUBSTANTIAL FACTOR" INCLUDES ANY USE OF AN ARTIFICIAL INTELLIGENCE SYSTEM TO GENERATE ANY CONTENT, DECISION, PREDICTION, OR RECOMMENDATION CONCERNING A CONSUMER THAT IS USED AS A BASIS TO MAKE A CONSEQUENTIAL DECISION CONCERNING THE CONSUMER.

(12) "TRADE SECRET" HAS THE MEANING SET FORTH IN SECTION 7-74-102 (4).

# 6-1-1702. Developer duty to avoid algorithmic discrimination - required documentation.

(1) ON AND AFTER FEBRUARY 1, 2026, A DEVELOPER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL USE REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED AND CONTRACTED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM. IN ANY ENFORCEMENT ACTION BROUGHT ON OR AFTER FEBRUARY 1, 2026, BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1706, THERE IS A REBUTTABLE PRESUMPTION THAT A DEVELOPER USED REASONABLE CARE AS REQUIRED UNDER THIS SECTION IF THE DEVELOPER COMPLIED WITH THIS SECTION AND ANY ADDITIONAL REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES PROMULGATED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1707.

(2) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED IN SUBSECTION (6) OF THIS SECTION, A DEVELOPER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL MAKE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM:

(a) A GENERAL STATEMENT DESCRIBING THE REASONABLY FORESEEABLE USES AND KNOWN HARMFUL OR INAPPROPRIATE USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

PAGE 6-SENATE BILL 24-205

---
(b) DOCUMENTATION DISCLOSING:

(I) HIGH-LEVEL SUMMARIES OF THE TYPE OF DATA USED TO TRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(II) KNOWN OR REASONABLY FORESEEABLE LIMITATIONS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(III) THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(IV) THE INTENDED BENEFITS AND USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND

(V) ALL OTHER INFORMATION NECESSARY TO ALLOW THE DEPLOYER TO COMPLY WITH THE REQUIREMENTS OF SECTION 6-1-1703;

(c) DOCUMENTATION DESCRIBING:

(I) HOW THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS EVALUATED FOR PERFORMANCE AND MITIGATION OF ALGORITHMIC DISCRIMINATION BEFORE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS OFFERED, SOLD, LEASED, LICENSED, GIVEN, OR OTHERWISE MADE AVAILABLE TO THE DEPLOYER;

(II) THE DATA GOVERNANCE MEASURES USED TO COVER THE TRAINING DATASETS AND THE MEASURES USED TO EXAMINE THE SUITABILITY OF DATA SOURCES, POSSIBLE BIASES, AND APPROPRIATE MITIGATION;

(III) THE INTENDED OUTPUTS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(IV) THE MEASURES THE DEVELOPER HAS TAKEN TO MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE REASONABLY FORESEEABLE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND

---

PAGE 7-SENATE BILL 24-205
---

(V) HOW THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHOULD BE USED, NOT BE USED, AND BE MONITORED BY AN INDIVIDUAL WHEN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS USED TO MAKE, OR IS A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION; AND

(d) ANY ADDITIONAL DOCUMENTATION THAT IS REASONABLY NECESSARY TO ASSIST THE DEPLOYER IN UNDERSTANDING THE OUTPUTS AND MONITOR THE PERFORMANCE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM FOR RISKS OF ALGORITHMIC DISCRIMINATION.

(3) (a) EXCEPT AS PROVIDED IN SUBSECTION (6) OF THIS SECTION, A DEVELOPER THAT OFFERS, SELLS, LEASES, LICENSES, GIVES, OR OTHERWISE MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026, SHALL MAKE AVAILABLE TO THE DEPLOYER OR OTHER DEVELOPER, TO THE EXTENT FEASIBLE, THE DOCUMENTATION AND INFORMATION, THROUGH ARTIFACTS SUCH AS MODEL CARDS, DATASET CARDS, OR OTHER IMPACT ASSESSMENTS, NECESSARY FOR A DEPLOYER, OR FOR A THIRD PARTY CONTRACTED BY A DEPLOYER, TO COMPLETE AN IMPACT ASSESSMENT PURSUANT TO SECTION 6-1-1703 (3).

(b) A DEVELOPER THAT ALSO SERVES AS A DEPLOYER FOR A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT REQUIRED TO GENERATE THE DOCUMENTATION REQUIRED BY THIS SECTION UNLESS THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS PROVIDED TO AN UNAFFILIATED ENTITY ACTING AS A DEPLOYER.

(4) (a) ON AND AFTER FEBRUARY 1, 2026, A DEVELOPER SHALL MAKE AVAILABLE, IN A MANNER THAT IS CLEAR AND READILY AVAILABLE ON THE DEVELOPER'S WEBSITE OR IN A PUBLIC USE CASE INVENTORY, A STATEMENT SUMMARIZING:

(I) THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE DEVELOPER HAS DEVELOPED OR INTENTIONALLY AND SUBSTANTIALLY MODIFIED AND CURRENTLY MAKES AVAILABLE TO A DEPLOYER OR OTHER DEVELOPER; AND

(II) HOW THE DEVELOPER MANAGES KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE DEVELOPMENT OR INTENTIONAL AND SUBSTANTIAL MODIFICATION

PAGE 8-SENATE BILL 24-205

---
OF THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DESCRIBED IN ACCORDANCE WITH SUBSECTION (4)(a)(I) OF THIS SECTION.

(b) A DEVELOPER SHALL UPDATE THE STATEMENT DESCRIBED IN SUBSECTION (4)(a) OF THIS SECTION:

(I) AS NECESSARY TO ENSURE THAT THE STATEMENT REMAINS ACCURATE; AND

(II) NO LATER THAN NINETY DAYS AFTER THE DEVELOPER INTENTIONALLY AND SUBSTANTIALLY MODIFIES ANY HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DESCRIBED IN SUBSECTION (4)(a)(I) OF THIS SECTION.

(5) ON AND AFTER FEBRUARY 1, 2026, A DEVELOPER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL DISCLOSE TO THE ATTORNEY GENERAL, IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL, AND TO ALL KNOWN DEPLOYERS OR OTHER DEVELOPERS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION ARISING FROM THE INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WITHOUT UNREASONABLE DELAY BUT NO LATER THAN NINETY DAYS AFTER THE DATE ON WHICH:

(a) THE DEVELOPER DISCOVERS THROUGH THE DEVELOPER'S ONGOING TESTING AND ANALYSIS THAT THE DEVELOPER'S HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS BEEN DEPLOYED AND HAS CAUSED OR IS REASONABLY LIKELY TO HAVE CAUSED ALGORITHMIC DISCRIMINATION; OR

(b) THE DEVELOPER RECEIVES FROM A DEPLOYER A CREDIBLE REPORT THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS BEEN DEPLOYED AND HAS CAUSED ALGORITHMIC DISCRIMINATION.

(6) NOTHING IN SUBSECTIONS (2) TO (5) OF THIS SECTION REQUIRES A DEVELOPER TO DISCLOSE A TRADE SECRET, INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW, OR INFORMATION THAT WOULD CREATE A SECURITY RISK TO THE DEVELOPER.

(7) ON AND AFTER FEBRUARY 1, 2026, THE ATTORNEY GENERAL MAY REQUIRE THAT A DEVELOPER DISCLOSE TO THE ATTORNEY GENERAL, NO LATER THAN NINETY DAYS AFTER THE REQUEST AND IN A FORM AND MANNER

PAGE 9-SENATE BILL 24-205
---
# PRESCRIBED BY THE ATTORNEY GENERAL, THE STATEMENT OR DOCUMENTATION DESCRIBED IN SUBSECTION (2) OF THIS SECTION. THE ATTORNEY GENERAL MAY EVALUATE SUCH STATEMENT OR DOCUMENTATION TO ENSURE COMPLIANCE WITH THIS PART 17, AND THE STATEMENT OR DOCUMENTATION IS NOT SUBJECT TO DISCLOSURE UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24. IN A DISCLOSURE PURSUANT TO THIS SUBSECTION (7), A DEVELOPER MAY DESIGNATE THE STATEMENT OR DOCUMENTATION AS INCLUDING PROPRIETARY INFORMATION OR A TRADE SECRET. TO THE EXTENT THAT ANY INFORMATION CONTAINED IN THE STATEMENT OR DOCUMENTATION INCLUDES INFORMATION SUBJECT TO ATTORNEY-CLIENT PRIVILEGE OR WORK-PRODUCT PROTECTION, THE DISCLOSURE DOES NOT CONSTITUTE A WAIVER OF THE PRIVILEGE OR PROTECTION.

## 6-1-1703. Deployer duty to avoid algorithmic discrimination - risk management policy and program.

(1) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL USE REASONABLE CARE TO PROTECT CONSUMERS FROM ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION. IN ANY ENFORCEMENT ACTION BROUGHT ON OR AFTER FEBRUARY 1, 2026, BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1706, THERE IS A REBUTTABLE PRESUMPTION THAT A DEPLOYER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM USED REASONABLE CARE AS REQUIRED UNDER THIS SECTION IF THE DEPLOYER COMPLIED WITH THIS SECTION AND ANY ADDITIONAL REQUIREMENTS OR OBLIGATIONS AS SET FORTH IN RULES PROMULGATED BY THE ATTORNEY GENERAL PURSUANT TO SECTION 6-1-1707.

(2) (a) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED IN SUBSECTION (6) OF THIS SECTION, A DEPLOYER OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM SHALL IMPLEMENT A RISK MANAGEMENT POLICY AND PROGRAM TO GOVERN THE DEPLOYER'S DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM. THE RISK MANAGEMENT POLICY AND PROGRAM MUST SPECIFY AND INCORPORATE THE PRINCIPLES, PROCESSES, AND PERSONNEL THAT THE DEPLOYER USES TO IDENTIFY, DOCUMENT, AND MITIGATE KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION. THE RISK MANAGEMENT POLICY AND PROGRAM MUST BE AN ITERATIVE PROCESS PLANNED, IMPLEMENTED, AND REGULARLY AND SYSTEMATICALLY REVIEWED AND UPDATED OVER THE LIFE CYCLE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, REQUIRING REGULAR,

PAGE 10-SENATE BILL 24-205
---
SYSTEMATIC REVIEW AND UPDATES. A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED AND MAINTAINED PURSUANT TO THIS SUBSECTION (2) MUST BE REASONABLE CONSIDERING:

(I) (A) THE GUIDANCE AND STANDARDS SET FORTH IN THE LATEST VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF COMMERCE, STANDARD ISO/IEC 42001 OF THE INTERNATIONAL ORGANIZATION FOR STANDARDIZATION, OR ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS, IF THE STANDARDS ARE SUBSTANTIALLY EQUIVALENT TO OR MORE STRINGENT THAN THE REQUIREMENTS OF THIS PART 17; OR

(B) ANY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE ATTORNEY GENERAL, IN THE ATTORNEY GENERAL'S DISCRETION, MAY DESIGNATE;

(II) THE SIZE AND COMPLEXITY OF THE DEPLOYER;

(III) THE NATURE AND SCOPE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER, INCLUDING THE INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS; AND

(IV) THE SENSITIVITY AND VOLUME OF DATA PROCESSED IN CONNECTION WITH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER.

(b) A RISK MANAGEMENT POLICY AND PROGRAM IMPLEMENTED PURSUANT TO SUBSECTION (2)(a) OF THIS SECTION MAY COVER MULTIPLE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY THE DEPLOYER.

(3) (a) EXCEPT AS PROVIDED IN SUBSECTIONS (3)(d), (3)(c), AND (6) OF THIS SECTION:

(I) A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, THAT DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026, SHALL COMPLETE AN IMPACT ASSESSMENT FOR THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND

---

PAGE 11-SENATE BILL 24-205
---
(II) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, SHALL COMPLETE AN IMPACT ASSESSMENT FOR A DEPLOYED HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AT LEAST ANNUALLY AND WITHIN NINETY DAYS AFTER ANY INTENTIONAL AND SUBSTANTIAL MODIFICATION TO THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS MADE AVAILABLE.

(b) AN IMPACT ASSESSMENT COMPLETED PURSUANT TO THIS SUBSECTION (3) MUST INCLUDE, AT A MINIMUM, AND TO THE EXTENT REASONABLY KNOWN BY OR AVAILABLE TO THE DEPLOYER:

(I) A STATEMENT BY THE DEPLOYER DISCLOSING THE PURPOSE, INTENDED USE CASES, AND DEPLOYMENT CONTEXT OF, AND BENEFITS AFFORDED BY, THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(II) AN ANALYSIS OF WHETHER THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM POSES ANY KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION AND, IF SO, THE NATURE OF THE ALGORITHMIC DISCRIMINATION AND THE STEPS THAT HAVE BEEN TAKEN TO MITIGATE THE RISKS;

(III) A DESCRIPTION OF THE CATEGORIES OF DATA THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSES AS INPUTS AND THE OUTPUTS THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PRODUCES;

(IV) IF THE DEPLOYER USED DATA TO CUSTOMIZE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, AN OVERVIEW OF THE CATEGORIES OF DATA THE DEPLOYER USED TO CUSTOMIZE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(V) ANY METRICS USED TO EVALUATE THE PERFORMANCE AND KNOWN LIMITATIONS OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(VI) A DESCRIPTION OF ANY TRANSPARENCY MEASURES TAKEN CONCERNING THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING ANY MEASURES TAKEN TO DISCLOSE TO A CONSUMER THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS IN USE WHEN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS IN USE; AND

(VII) A DESCRIPTION OF THE POST-DEPLOYMENT MONITORING AND

PAGE 12-SENATE BILL 24-205
---
USER SAFEGUARDS PROVIDED CONCERNING THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, INCLUDING THE OVERSIGHT, USE, AND LEARNING PROCESS ESTABLISHED BY THE DEPLOYER TO ADDRESS ISSUES ARISING FROM THE DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(c) IN ADDITION TO THE INFORMATION REQUIRED UNDER SUBSECTION (3)(b) OF THIS SECTION, AN IMPACT ASSESSMENT COMPLETED PURSUANT TO THIS SUBSECTION (3) FOLLOWING AN INTENTIONAL AND SUBSTANTIAL MODIFICATION TO A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026, MUST INCLUDE A STATEMENT DISCLOSING THE EXTENT TO WHICH THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM WAS USED IN A MANNER THAT WAS CONSISTENT WITH, OR VARIED FROM, THE DEVELOPER'S INTENDED USES OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(d) A SINGLE IMPACT ASSESSMENT MAY ADDRESS A COMPARABLE SET OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS DEPLOYED BY A DEPLOYER.

(e) IF A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, COMPLETES AN IMPACT ASSESSMENT FOR THE PURPOSE OF COMPLYING WITH ANOTHER APPLICABLE LAW OR REGULATION, THE IMPACT ASSESSMENT SATISFIES THE REQUIREMENTS ESTABLISHED IN THIS SUBSECTION (3) IF THE IMPACT ASSESSMENT IS REASONABLY SIMILAR IN SCOPE AND EFFECT TO THE IMPACT ASSESSMENT THAT WOULD OTHERWISE BE COMPLETED PURSUANT TO THIS SUBSECTION (3).

(f) A DEPLOYER SHALL MAINTAIN THE MOST RECENTLY COMPLETED IMPACT ASSESSMENT FOR A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AS REQUIRED UNDER THIS SUBSECTION (3), ALL RECORDS CONCERNING EACH IMPACT ASSESSMENT, AND ALL PRIOR IMPACT ASSESSMENTS, IF ANY, FOR AT LEAST THREE YEARS FOLLOWING THE FINAL DEPLOYMENT OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(g) ON OR BEFORE FEBRUARY 1, 2026, AND AT LEAST ANNUALLY THEREAFTER, A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, MUST REVIEW THE DEPLOYMENT OF EACH HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DEPLOYED BY THE DEPLOYER TO ENSURE THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS NOT CAUSING ALGORITHMIC DISCRIMINATION.

PAGE 13-SENATE BILL 24-205
---

(4) (a) ON AND AFTER FEBRUARY 1, 2026, AND NO LATER THAN THE TIME THAT A DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION CONCERNING A CONSUMER, THE DEPLOYER SHALL:

(I) NOTIFY THE CONSUMER THAT THE DEPLOYER HAS DEPLOYED A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION BEFORE THE DECISION IS MADE;

(II) PROVIDE TO THE CONSUMER A STATEMENT DISCLOSING THE PURPOSE OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AND THE NATURE OF THE CONSEQUENTIAL DECISION; THE CONTACT INFORMATION FOR THE DEPLOYER; A DESCRIPTION, IN PLAIN LANGUAGE, OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM; AND INSTRUCTIONS ON HOW TO ACCESS THE STATEMENT REQUIRED BY SUBSECTION (5)(a) OF THIS SECTION; AND

(III) PROVIDE TO THE CONSUMER INFORMATION, IF APPLICABLE, REGARDING THE CONSUMER'S RIGHT TO OPT OUT OF THE PROCESSING OF PERSONAL DATA CONCERNING THE CONSUMER FOR PURPOSES OF PROFILING IN FURTHERANCE OF DECISIONS THAT PRODUCE LEGAL OR SIMILARLY SIGNIFICANT EFFECTS CONCERNING THE CONSUMER UNDER SECTION 6-1-1306 (1)(a)(I)(C).

(b) ON AND AFTER FEBRUARY 1, 2026, A DEPLOYER THAT HAS DEPLOYED A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM TO MAKE, OR BE A SUBSTANTIAL FACTOR IN MAKING, A CONSEQUENTIAL DECISION CONCERNING A CONSUMER SHALL, IF THE CONSEQUENTIAL DECISION IS ADVERSE TO THE CONSUMER, PROVIDE TO THE CONSUMER:

(I) A STATEMENT DISCLOSING THE PRINCIPAL REASON OR REASONS FOR THE CONSEQUENTIAL DECISION, INCLUDING:

(A) THE DEGREE TO WHICH, AND MANNER IN WHICH, THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM CONTRIBUTED TO THE CONSEQUENTIAL DECISION;

(B) THE TYPE OF DATA THAT WAS PROCESSED BY THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IN MAKING THE CONSEQUENTIAL

PAGE 14-SENATE BILL 24-205

---
# DECISION; AND

(C) THE SOURCE OR SOURCES OF THE DATA DESCRIBED IN SUBSECTION (4)(b)(I)(B) OF THIS SECTION;

(II) AN OPPORTUNITY TO CORRECT ANY INCORRECT PERSONAL DATA THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM PROCESSED IN MAKING, OR AS A SUBSTANTIAL FACTOR IN MAKING, THE CONSEQUENTIAL DECISION; AND

(III) AN OPPORTUNITY TO APPEAL AN ADVERSE CONSEQUENTIAL DECISION CONCERNING THE CONSUMER ARISING FROM THE DEPLOYMENT OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM, WHICH APPEAL MUST, IF TECHNICALLY FEASIBLE, ALLOW FOR HUMAN REVIEW UNLESS PROVIDING THE OPPORTUNITY FOR APPEAL IS NOT IN THE BEST INTEREST OF THE CONSUMER, INCLUDING IN INSTANCES IN WHICH ANY DELAY MIGHT POSE A RISK TO THE LIFE OR SAFETY OF SUCH CONSUMER.

(c) (I) EXCEPT AS PROVIDED IN SUBSECTION (4)(c)(II) OF THIS SECTION, A DEPLOYER SHALL PROVIDE THE NOTICE, STATEMENT, CONTACT INFORMATION, AND DESCRIPTION REQUIRED BY SUBSECTIONS (4)(a) AND (4)(b) OF THIS SECTION:

(A) DIRECTLY TO THE CONSUMER;

(B) IN PLAIN LANGUAGE;

(C) IN ALL LANGUAGES IN WHICH THE DEPLOYER, IN THE ORDINARY COURSE OF THE DEPLOYER'S BUSINESS, PROVIDES CONTRACTS, DISCLAIMERS, SALE ANNOUNCEMENTS, AND OTHER INFORMATION TO CONSUMERS; AND

(D) IN A FORMAT THAT IS ACCESSIBLE TO CONSUMERS WITH DISABILITIES.

(II) IF THE DEPLOYER IS UNABLE TO PROVIDE THE NOTICE, STATEMENT, CONTACT INFORMATION, AND DESCRIPTION REQUIRED BY SUBSECTIONS (4)(a) AND (4)(b) OF THIS SECTION DIRECTLY TO THE CONSUMER, THE DEPLOYER SHALL MAKE THE NOTICE, STATEMENT, CONTACT INFORMATION, AND DESCRIPTION AVAILABLE IN A MANNER THAT IS REASONABLY CALCULATED TO ENSURE THAT THE CONSUMER RECEIVES THE

PAGE 15-SENATE BILL 24-205
---
```
NOTICE, STATEMENT, CONTACT INFORMATION, AND DESCRIPTION.

(5)(a) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED IN SUBSECTION (6) OF THIS SECTION, A DEPLOYER SHALL MAKE AVAILABLE, IN A MANNER THAT IS CLEAR AND READILY AVAILABLE ON THE DEPLOYER'S WEBSITE, A STATEMENT SUMMARIZING:

(I) THE TYPES OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS THAT ARE CURRENTLY DEPLOYED BY THE DEPLOYER;

(II) HOW THE DEPLOYER MANAGES KNOWN OR REASONABLY FORESEEABLE RISKS OF ALGORITHMIC DISCRIMINATION THAT MAY ARISE FROM THE DEPLOYMENT OF EACH HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM DESCRIBED PURSUANT TO SUBSECTION (5)(a)(I) OF THIS SECTION; AND

(III) IN DETAIL, THE NATURE, SOURCE, AND EXTENT OF THE INFORMATION COLLECTED AND USED BY THE DEPLOYER.

(b) A DEPLOYER SHALL PERIODICALLY UPDATE THE STATEMENT DESCRIBED IN SUBSECTION (5)(a) OF THIS SECTION.

(6) SUBSECTIONS (2), (3), AND (5) OF THIS SECTION DO NOT APPLY TO A DEPLOYER IF, AT THE TIME THE DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM AND AT ALL TIMES WHILE THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM IS DEPLOYED:

(a) THE DEPLOYER:

(I) EMPLOYS FEWER THAN FIFTY FULL-TIME EQUIVALENT EMPLOYEES; AND

(II) DOES NOT USE THE DEPLOYER'S OWN DATA TO TRAIN THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM;

(b) THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM:

(I) IS USED FOR THE INTENDED USES THAT ARE DISCLOSED TO THE DEPLOYER AS REQUIRED BY SECTION 6-1-1702 (2)(a); AND

PAGE 16-SENATE BILL 24-205
```
---
(II) CONTINUES LEARNING BASED ON DATA DERIVED FROM SOURCES OTHER THAN THE DEPLOYER'S OWN DATA; AND

(c) THE DEPLOYER MAKES AVAILABLE TO CONSUMERS ANY IMPACT ASSESSMENT THAT:

(I) THE DEVELOPER OF THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS COMPLETED AND PROVIDED TO THE DEPLOYER; AND

(II) INCLUDES INFORMATION THAT IS SUBSTANTIALLY SIMILAR TO THE INFORMATION IN THE IMPACT ASSESSMENT REQUIRED UNDER SUBSECTION (3)(b) OF THIS SECTION.

(7) IF A DEPLOYER DEPLOYS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM ON OR AFTER FEBRUARY 1, 2026, AND SUBSEQUENTLY DISCOVERS THAT THE HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM HAS CAUSED ALGORITHMIC DISCRIMINATION, THE DEPLOYER, WITHOUT UNREASONABLE DELAY, BUT NO LATER THAN NINETY DAYS AFTER THE DATE OF THE DISCOVERY, SHALL SEND TO THE ATTORNEY GENERAL, IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL, A NOTICE DISCLOSING THE DISCOVERY.

(8) NOTHING IN SUBSECTIONS (2) TO (5) AND (7) OF THIS SECTION REQUIRES A DEPLOYER TO DISCLOSE A TRADE SECRET OR INFORMATION PROTECTED FROM DISCLOSURE BY STATE OR FEDERAL LAW. TO THE EXTENT THAT A DEPLOYER WITHHOLDS INFORMATION PURSUANT TO THIS SUBSECTION (8) OR SECTION 6-1-1705 (5), THE DEPLOYER SHALL NOTIFY THE CONSUMER AND PROVIDE A BASIS FOR THE WITHHOLDING.

(9) ON AND AFTER FEBRUARY 1, 2026, THE ATTORNEY GENERAL MAY REQUIRE THAT A DEPLOYER, OR A THIRD PARTY CONTRACTED BY THE DEPLOYER, DISCLOSE TO THE ATTORNEY GENERAL, NO LATER THAN NINETY DAYS AFTER THE REQUEST AND IN A FORM AND MANNER PRESCRIBED BY THE ATTORNEY GENERAL, THE RISK MANAGEMENT POLICY IMPLEMENTED PURSUANT TO SUBSECTION (2) OF THIS SECTION, THE IMPACT ASSESSMENT COMPLETED PURSUANT TO SUBSECTION (3) OF THIS SECTION, OR THE RECORDS MAINTAINED PURSUANT TO SUBSECTION (3)(f) OF THIS SECTION. THE ATTORNEY GENERAL MAY EVALUATE THE RISK MANAGEMENT POLICY, IMPACT ASSESSMENT, OR RECORDS TO ENSURE COMPLIANCE WITH THIS PART 17, AND THE RISK MANAGEMENT POLICY, IMPACT ASSESSMENT, AND
---
# RECORDS ARE NOT SUBJECT TO DISCLOSURE UNDER THE "COLORADO OPEN RECORDS ACT", PART 2 OF ARTICLE 72 OF TITLE 24. IN A DISCLOSURE PURSUANT TO THIS SUBSECTION (9), A DEPLOYER MAY DESIGNATE THE STATEMENT OR DOCUMENTATION AS INCLUDING PROPRIETARY INFORMATION OR A TRADE SECRET. TO THE EXTENT THAT ANY INFORMATION CONTAINED IN THE RISK MANAGEMENT POLICY, IMPACT ASSESSMENT, OR RECORDS INCLUDE INFORMATION SUBJECT TO ATTORNEY-CLIENT PRIVILEGE OR WORK-PRODUCT PROTECTION, THE DISCLOSURE DOES NOT CONSTITUTE A WAIVER OF THE PRIVILEGE OR PROTECTION.

## 6-1-1704. Disclosure of an artificial intelligence system to consumer.
(1) ON AND AFTER FEBRUARY 1, 2026, AND EXCEPT AS PROVIDED IN SUBSECTION (2) OF THIS SECTION, A DEPLOYER OR OTHER DEVELOPER THAT DEPLOYS, OFFERS, SELLS, LEASES, LICENSES, GIVES, OR OTHERWISE MAKES AVAILABLE AN ARTIFICIAL INTELLIGENCE SYSTEM THAT IS INTENDED TO INTERACT WITH CONSUMERS SHALL ENSURE THE DISCLOSURE TO EACH CONSUMER WHO INTERACTS WITH THE ARTIFICIAL INTELLIGENCE SYSTEM THAT THE CONSUMER IS INTERACTING WITH AN ARTIFICIAL INTELLIGENCE SYSTEM.

(2) DISCLOSURE IS NOT REQUIRED UNDER SUBSECTION (1) OF THIS SECTION UNDER CIRCUMSTANCES IN WHICH IT WOULD BE OBVIOUS TO A REASONABLE PERSON THAT THE PERSON IS INTERACTING WITH AN ARTIFICIAL INTELLIGENCE SYSTEM.

## 6-1-1705. Compliance with other legal obligations - definitions.
(1) NOTHING IN THIS PART 17 RESTRICTS A DEVELOPER'S, A DEPLOYER'S, OR OTHER PERSON'S ABILITY TO:

(a) COMPLY WITH FEDERAL, STATE, OR MUNICIPAL LAWS, ORDINANCES, OR REGULATIONS;

(b) COMPLY WITH A CIVIL, CRIMINAL, OR REGULATORY INQUIRY, INVESTIGATION, SUBPOENA, OR SUMMONS BY A FEDERAL, A STATE, A MUNICIPAL, OR OTHER GOVERNMENTAL AUTHORITY;

(c) COOPERATE WITH A LAW ENFORCEMENT AGENCY CONCERNING CONDUCT OR ACTIVITY THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON REASONABLY AND IN GOOD FAITH BELIEVES MAY VIOLATE FEDERAL, STATE, OR MUNICIPAL LAWS, ORDINANCES, OR REGULATIONS;

---

PAGE 18-SENATE BILL 24-205
---
```
(d) INVESTIGATE, ESTABLISH, EXERCISE, PREPARE FOR, OR DEFEND LEGAL CLAIMS;

(e) TAKE IMMEDIATE STEPS TO PROTECT AN INTEREST THAT IS ESSENTIAL FOR THE LIFE OR PHYSICAL SAFETY OF A CONSUMER OR ANOTHER INDIVIDUAL;

(f) BY ANY MEANS OTHER THAN THE USE OF FACIAL RECOGNITION TECHNOLOGY, PREVENT, DETECT, PROTECT AGAINST, OR RESPOND TO SECURITY INCIDENTS, IDENTITY THEFT, FRAUD, HARASSMENT, MALICIOUS OR DECEPTIVE ACTIVITIES, OR ILLEGAL ACTIVITY; INVESTIGATE, REPORT, OR PROSECUTE THE PERSONS RESPONSIBLE FOR ANY SUCH ACTION; OR PRESERVE THE INTEGRITY OR SECURITY OF SYSTEMS;

(g) ENGAGE IN PUBLIC OR PEER-REVIEWED SCIENTIFIC OR STATISTICAL RESEARCH IN THE PUBLIC INTEREST THAT ADHERES TO ALL OTHER APPLICABLE ETHICS AND PRIVACY LAWS AND IS CONDUCTED IN ACCORDANCE WITH 45 CFR 46, AS AMENDED, OR RELEVANT REQUIREMENTS ESTABLISHED BY THE FEDERAL FOOD AND DRUG ADMINISTRATION;

(h) CONDUCT RESEARCH, TESTING, AND DEVELOPMENT ACTIVITIES REGARDING AN ARTIFICIAL INTELLIGENCE SYSTEM OR MODEL, OTHER THAN TESTING CONDUCTED UNDER REAL-WORLD CONDITIONS, BEFORE THE ARTIFICIAL INTELLIGENCE SYSTEM OR MODEL IS PLACED ON THE MARKET, DEPLOYED, OR PUT INTO SERVICE, AS APPLICABLE; OR

(i) ASSIST ANOTHER DEVELOPER, DEPLOYER, OR OTHER PERSON WITH ANY OF THE OBLIGATIONS IMPOSED UNDER THIS PART 17.

(2) THE OBLIGATIONS IMPOSED ON DEVELOPERS, DEPLOYERS, OR OTHER PERSONS UNDER THIS PART 17 DO NOT RESTRICT A DEVELOPER'S, A DEPLOYER'S, OR OTHER PERSON'S ABILITY TO:

(a) EFFECTUATE A PRODUCT RECALL; OR

(b) IDENTIFY AND REPAIR TECHNICAL ERRORS THAT IMPAIR EXISTING OR INTENDED FUNCTIONALITY.

(3) THE OBLIGATIONS IMPOSED ON DEVELOPERS, DEPLOYERS, OR OTHER PERSONS UNDER THIS PART 17 DO NOT APPLY WHERE COMPLIANCE
```

---
WITH THIS PART 17 BY THE DEVELOPER, DEPLOYER, OR OTHER PERSON WOULD VIOLATE AN EVIDENTIARY PRIVILEGE UNDER THE LAWS OF THIS STATE.

(4) NOTHING IN THIS PART 17 IMPOSES ANY OBLIGATION ON A DEVELOPER, A DEPLOYER, OR OTHER PERSON THAT ADVERSELY AFFECTS THE RIGHTS OR FREEDOMS OF A PERSON, INCLUDING THE RIGHTS OF A PERSON TO FREEDOM OF SPEECH OR FREEDOM OF THE PRESS THAT ARE GUARANTEED IN:

(a) THE FIRST AMENDMENT TO THE UNITED STATES CONSTITUTION; OR

(b) SECTION 10 OF ARTICLE II OF THE STATE CONSTITUTION.

(5) NOTHING IN THIS PART 17 APPLIES TO A DEVELOPER, A DEPLOYER, OR OTHER PERSON:

(a) INSOFAR AS THE DEVELOPER, DEPLOYER, OR OTHER PERSON DEVELOPS, DEPLOYS, PUTS INTO SERVICE, OR INTENTIONALLY AND SUBSTANTIALLY MODIFIES, AS APPLICABLE, A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM:

(I) THAT HAS BEEN APPROVED, AUTHORIZED, CERTIFIED, CLEARED, DEVELOPED, OR GRANTED BY A FEDERAL AGENCY, SUCH AS THE FEDERAL FOOD AND DRUG ADMINISTRATION OR THE FEDERAL AVIATION ADMINISTRATION, ACTING WITHIN THE SCOPE OF THE FEDERAL AGENCY'S AUTHORITY, OR BY A REGULATED ENTITY SUBJECT TO THE SUPERVISION AND REGULATION OF THE FEDERAL HOUSING FINANCE AGENCY; OR

(II) IN COMPLIANCE WITH STANDARDS ESTABLISHED BY A FEDERAL AGENCY, INCLUDING STANDARDS ESTABLISHED BY THE FEDERAL OFFICE OF THE NATIONAL COORDINATOR FOR HEALTH INFORMATION TECHNOLOGY, OR BY A REGULATED ENTITY SUBJECT TO THE SUPERVISION AND REGULATION OF THE FEDERAL HOUSING FINANCE AGENCY, IF THE STANDARDS ARE SUBSTANTIALLY EQUIVALENT OR MORE STRINGENT THAN THE REQUIREMENTS OF THIS PART 17;

(b) CONDUCTING RESEARCH TO SUPPORT AN APPLICATION FOR APPROVAL OR CERTIFICATION FROM A FEDERAL AGENCY, INCLUDING THE FEDERAL AVIATION ADMINISTRATION, THE FEDERAL COMMUNICATIONS

PAGE 20-SENATE BILL 24-205
---
```
COMMISSION, OR THE FEDERAL FOOD AND DRUG ADMINISTRATION OR RESEARCH TO SUPPORT AN APPLICATION OTHERWISE SUBJECT TO REVIEW BY THE FEDERAL AGENCY;

(c) PERFORMING WORK UNDER, OR IN CONNECTION WITH, A CONTRACT WITH THE UNITED STATES DEPARTMENT OF COMMERCE, THE UNITED STATES DEPARTMENT OF DEFENSE, OR THE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION, UNLESS THE DEVELOPER, DEPLOYER, OR OTHER PERSON IS PERFORMING THE WORK ON A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT IS USED TO MAKE, OR IS A SUBSTANTIAL FACTOR IN MAKING, A DECISION CONCERNING EMPLOYMENT OR HOUSING; OR

(d) THAT IS A COVERED ENTITY WITHIN THE MEANING OF THE FEDERAL "HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996", 42 U.S.C. SECS. 1320d TO 1320d-9, AND THE REGULATIONS PROMULGATED UNDER THE FEDERAL ACT, AS BOTH MAY BE AMENDED FROM TIME TO TIME, AND IS PROVIDING HEALTH-CARE RECOMMENDATIONS THAT:

(I) ARE GENERATED BY AN ARTIFICIAL INTELLIGENCE SYSTEM;

(II) REQUIRE A HEALTH-CARE PROVIDER TO TAKE ACTION TO IMPLEMENT THE RECOMMENDATIONS; AND

(III) ARE NOT CONSIDERED TO BE HIGH RISK.

(6) NOTHING IN THIS PART 17 APPLIES TO ANY ARTIFICIAL INTELLIGENCE SYSTEM THAT IS ACQUIRED BY OR FOR THE FEDERAL GOVERNMENT OR ANY FEDERAL AGENCY OR DEPARTMENT, INCLUDING THE UNITED STATES DEPARTMENT OF COMMERCE, THE UNITED STATES DEPARTMENT OF DEFENSE, OR THE NATIONAL AERONAUTICS AND SPACE ADMINISTRATION, UNLESS THE ARTIFICIAL INTELLIGENCE SYSTEM IS A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM THAT IS USED TO MAKE, OR IS A SUBSTANTIAL FACTOR IN MAKING, A DECISION CONCERNING EMPLOYMENT OR HOUSING.

(7) AN INSURER, AS DEFINED IN SECTION 10-1-102 (13), A FRATERNAL BENEFIT SOCIETY, AS DESCRIBED IN SECTION 10-14-102, OR A DEVELOPER OF AN ARTIFICIAL INTELLIGENCE SYSTEM USED BY AN INSURER IS IN FULL COMPLIANCE WITH THIS PART 17 IF THE INSURER, THE FRATERNAL BENEFIT SOCIETY, OR THE DEVELOPER IS SUBJECT TO THE REQUIREMENTS OF

PAGE 21-SENATE BILL 24-205
```
---
SECTION 10-3-1104.9 AND ANY RULES ADOPTED BY THE COMMISSIONER OF INSURANCE PURSUANT TO SECTION 10-3-1104.9.

(8)(a) A BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT UNION, OR ANY AFFILIATE OR SUBSIDIARY THEREOF, IS IN FULL COMPLIANCE WITH THIS PART 17 IF THE BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT UNION, OR AFFILIATE OR SUBSIDIARY IS SUBJECT TO EXAMINATION BY A STATE OR FEDERAL PRUDENTIAL REGULATOR UNDER ANY PUBLISHED GUIDANCE OR REGULATIONS THAT APPLY TO THE USE OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS AND THE GUIDANCE OR REGULATIONS:

(I) IMPOSE REQUIREMENTS THAT ARE SUBSTANTIALLY EQUIVALENT TO OR MORE STRINGENT THAN THE REQUIREMENTS IMPOSED IN THIS PART 17; AND

(II) AT A MINIMUM, REQUIRE THE BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT UNION, OR AFFILIATE OR SUBSIDIARY TO:

(A) REGULARLY AUDIT THE BANK'S, OUT-OF-STATE BANK'S, CREDIT UNION CHARTERED BY THE STATE OF COLORADO'S, FEDERAL CREDIT UNION'S, OUT-OF-STATE CREDIT UNION'S, OR AFFILIATE'S OR SUBSIDIARY'S USE OF HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEMS FOR COMPLIANCE WITH STATE AND FEDERAL ANTI-DISCRIMINATION LAWS AND REGULATIONS APPLICABLE TO THE BANK, OUT-OF-STATE BANK, CREDIT UNION CHARTERED BY THE STATE OF COLORADO, FEDERAL CREDIT UNION, OUT-OF-STATE CREDIT UNION, OR AFFILIATE OR SUBSIDIARY; AND

(B) MITIGATE ANY ALGORITHMIC DISCRIMINATION CAUSED BY THE USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM OR ANY RISK OF ALGORITHMIC DISCRIMINATION THAT IS REASONABLY FORESEEABLE AS A RESULT OF THE USE OF A HIGH-RISK ARTIFICIAL INTELLIGENCE SYSTEM.

(b) AS USED IN THIS SUBSECTION (8):

(I) "AFFILIATE" HAS THE MEANING SET FORTH IN SECTION 11-101-401 (3.5).

PAGE 22-SENATE BILL 24-205
---
```
(II) "BANK" HAS THE MEANING SET FORTH IN SECTION 11-101-401 (5).

(III) "CREDIT UNION" HAS THE MEANING SET FORTH IN SECTION 11-30-101 (1)(a).

(IV) "OUT-OF-STATE BANK" HAS THE MEANING SET FORTH IN SECTION 11-101-401 (50).

(9) IF A DEVELOPER, A DEPLOYER, OR OTHER PERSON ENGAGES IN AN ACTION PURSUANT TO AN EXEMPTION SET FORTH IN THIS SECTION, THE DEVELOPER, DEPLOYER, OR OTHER PERSON BEARS THE BURDEN OF DEMONSTRATING THAT THE ACTION QUALIFIES FOR THE EXEMPTION.

## 6-1-1706. Enforcement by attorney general.
(1) NOTWITHSTANDING SECTION 6-1-103, THE ATTORNEY GENERAL HAS EXCLUSIVE AUTHORITY TO ENFORCE THIS PART 17.

(2) EXCEPT AS PROVIDED IN SUBSECTION (3) OF THIS SECTION, A VIOLATION OF THE REQUIREMENTS ESTABLISHED IN THIS PART 17 CONSTITUTES AN UNFAIR TRADE PRACTICE PURSUANT TO SECTION 6-1-105 (1)(hhhh).

(3) IN ANY ACTION COMMENCED BY THE ATTORNEY GENERAL TO ENFORCE THIS PART 17, IT IS AN AFFIRMATIVE DEFENSE THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON:

(a) DISCOVERS AND CURES A VIOLATION OF THIS PART 17 AS A RESULT OF:

(I) FEEDBACK THAT THE DEVELOPER, DEPLOYER, OR OTHER PERSON ENCOURAGES DEPLOYERS OR USERS TO PROVIDE TO THE DEVELOPER, DEPLOYER, OR OTHER PERSON;

(II) ADVERSARIAL TESTING OR RED TEAMING, AS THOSE TERMS ARE DEFINED OR USED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY; OR

(III) AN INTERNAL REVIEW PROCESS; AND

PAGE 23-SENATE BILL 24-205
```
---
(b) IS OTHERWISE IN COMPLIANCE WITH:

(I) THE LATEST VERSION OF THE "ARTIFICIAL INTELLIGENCE RISK MANAGEMENT FRAMEWORK" PUBLISHED BY THE NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY IN THE UNITED STATES DEPARTMENT OF COMMERCE AND STANDARD ISO/IEC 42001 OF THE INTERNATIONAL ORGANIZATION FOR STANDARDIZATION;

(II) ANOTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS, IF THE STANDARDS ARE SUBSTANTIALLY EQUIVALENT TO OR MORE STRINGENT THAN THE REQUIREMENTS OF THIS PART 17; OR

(III) ANY RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS THAT THE ATTORNEY GENERAL, IN THE ATTORNEY GENERAL'S DISCRETION, MAY DESIGNATE AND, IF DESIGNATED, SHALL PUBLICLY DISSEMINATE.

(4) A DEVELOPER, A DEPLOYER, OR OTHER PERSON BEARS THE BURDEN OF DEMONSTRATING TO THE ATTORNEY GENERAL THAT THE REQUIREMENTS ESTABLISHED IN SUBSECTION (3) OF THIS SECTION HAVE BEEN SATISFIED.

(5) NOTHING IN THIS PART 17, INCLUDING THE ENFORCEMENT AUTHORITY GRANTED TO THE ATTORNEY GENERAL UNDER THIS SECTION, PREEMPTS OR OTHERWISE AFFECTS ANY RIGHT, CLAIM, REMEDY, PRESUMPTION, OR DEFENSE AVAILABLE AT LAW OR IN EQUITY. A REBUTTABLE PRESUMPTION OR AFFIRMATIVE DEFENSE ESTABLISHED UNDER THIS PART 17 APPLIES ONLY TO AN ENFORCEMENT ACTION BROUGHT BY THE ATTORNEY GENERAL PURSUANT TO THIS SECTION AND DOES NOT APPLY TO ANY RIGHT, CLAIM, REMEDY, PRESUMPTION, OR DEFENSE AVAILABLE AT LAW OR IN EQUITY.

(6) THIS PART 17 DOES NOT PROVIDE THE BASIS FOR, AND IS NOT SUBJECT TO, A PRIVATE RIGHT OF ACTION FOR VIOLATIONS OF THIS PART 17 OR ANY OTHER LAW.

## 6-1-1707. Rules.
(1) THE ATTORNEY GENERAL MAY PROMULGATE RULES AS NECESSARY FOR THE PURPOSE OF IMPLEMENTING AND ENFORCING THIS PART 17, INCLUDING:

PAGE 24-SENATE BILL 24-205
---
```
(a) THE DOCUMENTATION AND REQUIREMENTS FOR DEVELOPERS PURSUANT TO SECTION 6-1-1702 (2);

(b) THE CONTENTS OF AND REQUIREMENTS FOR THE NOTICES AND DISCLOSURES REQUIRED BY SECTIONS 6-1-1702 (5) AND (7); 6-1-1703 (4), (5), (7), AND (9); AND 6-1-1704;

(c) THE CONTENT AND REQUIREMENTS OF THE RISK MANAGEMENT POLICY AND PROGRAM REQUIRED BY SECTION 6-1-1703 (2);

(d) THE CONTENT AND REQUIREMENTS OF THE IMPACT ASSESSMENTS REQUIRED BY SECTION 6-1-1703 (3);

(e) THE REQUIREMENTS FOR THE REBUTTABLE PRESUMPTIONS SET FORTH IN SECTIONS 6-1-1702 AND 6-1-1703; AND

(f) THE REQUIREMENTS FOR THE AFFIRMATIVE DEFENSE SET FORTH IN SECTION 6-1-1706 (3), INCLUDING THE PROCESS BY WHICH THE ATTORNEY GENERAL WILL RECOGNIZE ANY OTHER NATIONALLY OR INTERNATIONALLY RECOGNIZED RISK MANAGEMENT FRAMEWORK FOR ARTIFICIAL INTELLIGENCE SYSTEMS.

SECTION 2. In Colorado Revised Statutes, 6-1-105, add (1)(hhhh) as follows:

6-1-105. Unfair or deceptive trade practices. (1) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person:

(hhhh) VIOLATES PART 17 OF THIS ARTICLE 1.

SECTION 3. Safety clause. The general assembly finds, determines, and declares that this act is necessary for the immediate preservation of the public peace, health, or safety or for appropriations for
```

---
the support and maintenance of the departments of the state and state institutions.

| Steve Fenberg | | Julie McCluskie |
|---------------|------------------|-------------------|
| PRESIDENT OF  | | SPEAKER OF THE HOUSE |
| THE SENATE    | | OF REPRESENTATIVES  |

| Cindi L. Markwell | | Robin Jones |
|-------------------|------------------|-------------------|
| SECRETARY OF     | | CHIEF CLERK OF THE HOUSE |
| THE SENATE       | | OF REPRESENTATIVES       |

APPROVED___________________________

(Date and Time)

___________________________

Jared S. Polis
GOVERNOR OF THE STATE OF COLORADO

PAGE 26-SENATE BILL 24-205