Privacy Law Library

Colorado Privacy Act minors' online protections (Privacy Protections for Children's Online Data)

CPA minors (SB 24-041)

Children · Location

SB 24-041 added a minors' duty of care to the Colorado Privacy Act for online services known to be used by anyone under 18. Without the minor's consent (or a parent's for children under 13), controllers may not use minors' data for targeted ads, sale, or significant profiling, use engagement-extending design features, or collect precise geolocation beyond what is needed. Heightened-risk services need a minors' data protection assessment.

Where
Colorado
Citation
C.R.S. 6-1-1305.5, 6-1-1308.5, 6-1-1309.5; 6-1-1303(16.5), (16.8); 6-1-1311(1)(d)(II)
Status
In force
In force since
2025-10-01
Enforced by
Colorado Attorney General and district attorneys
People can sue
No
Penalties
Deceptive trade practice under the Colorado Consumer Protection Act (up to $20,000 per violation); a 60-day notice-and-cure period applies to these sections until December 31, 2026 (6-1-1311(1)(d)(II)).
Applies to
  • Any controller that conducts business in Colorado or targets Colorado residents and offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18), with no revenue or volume threshold (6-1-1304(1)(b); 6-1-1303(16.5))
  • Excludes telecommunications and broadband service and delivery of physical products (6-1-1303(16.8))

Practices it requires

  • Use reasonable care to avoid any heightened risk of harm to minors caused by the online service, product, or feature; compliance creates a rebuttable presumption of reasonable care.C.R.S. 6-1-1308.5(1)
  • Without consent, do not process a minor's data for targeted advertising, sale, or legally significant profiling, for undisclosed incompatible purposes, or longer than necessary.C.R.S. 6-1-1308.5(2)(a), (3)(a)
  • Without consent, do not use system design features to significantly increase, sustain, or extend a minor's use.C.R.S. 6-1-1308.5(2)(b)
  • Collect a minor's precise geolocation only when reasonably necessary, only for as long as necessary, and with a visible signal to the minor during collection.C.R.S. 6-1-1308.5(2)(c)
  • Do not use consent mechanisms designed to subvert choice, and offer safeguards limiting unsolicited adult direct messages to minors (except email and private messaging services).C.R.S. 6-1-1308.5(3)(b)
  • Conduct, review, and keep for at least three years a data protection assessment for online features posing a heightened risk of harm to minors.C.R.S. 6-1-1309.5
  • Processors must assist controllers with the minors' duties.C.R.S. 6-1-1305.5

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.