If signed by Governor Jared Polis, Colorado SB 24-041 would enhance its privacy act protections when an under 13 year-old child’s data is processed and there is a heightened risk of harm applying to any entity that controls consumer personal data (controller) and that conducts business in Colorado or delivers products or services that are targeted at Colorado residents, regardless of the volume of or amount of revenue derived from that activity.

A data controller is also prohibited from:

• Using a system design feature to significantly increase, sustain, or extend the child’s use of the service, product, or feature; or
• Collecting a child’s precise geolocation, except under specified circumstances.

A data controller that offers an online service, product, or feature to a consumer that the controller knows or willfully disregards is a minor is required to:

• Use reasonable care to avoid any heightened risk of harm to minors caused by the service, product, or feature; and
• Conduct, and review as necessary, a data protection assessment for the service, product, or feature if there is a heightened risk of harm to minors and must maintain documentation regarding the assessments.

Unless the minor or the minor’s parent or legal guardian has consented, a controller is prohibited from processing the under 13 year-old child’s personal data:

• For targeted advertising, selling the child’s personal data, or profiling the minor’s personal data;
• For any processing purpose other than the purpose disclosed at the time the child’s personal data is collected or a purpose reasonably necessary for the disclosed processing purpose; or

The attorney general and district attorneys are authorized to enforce the requirements in the same manner as authorized under the Colorado Privacy Act, including notifying a controller of, and allowing a controller time to cure, a violation.

For further information about state privacy laws, please contact Jim Potter, CHC Executive Director at jpotter@cohealth.com.