Privacy Law Library

Age Attestation on Computing Devices

SB 26-051

Children

SB 26-051 requires device operating systems with app stores to ask for a user's birth date or age bracket at account setup and send an age signal to apps through an API, starting July 1, 2028. Apps must request the signal and are then treated as knowing the user's age range. It includes data-minimization limits: the age signal may not be shared with third parties for other purposes.

Where

Colorado

Citation

C.R.S. 6-30-101 to 6-30-105

Status

Enacted, not yet in force

In force since

2028-07-01

Enforced by

Colorado Attorney General

People can sue

No

Penalties

Civil penalty up to $2,500 per affected minor for each negligent violation and up to $7,500 per affected minor for each intentional violation, recovered by the Attorney General (6-30-104). Good-faith safe harbor for OS providers and app stores.

Applies to

• Operating system providers that run or preinstall a covered application store (6-30-101, 6-30-102)
• Developers of consumer software applications distributed through a covered application store (6-30-102)