Law note · Colorado

Colorado Privacy Act, publicly-available-information exemption and biometric data (as amended by HB 24-1130)

cite C.R.S. §§ 6-1-1301 et seq., 6-1-1303(2.2), (2.4), (17), (24) stage IN FORCE in force since 2025-07-01 kind Personal data binds private bodies reviewed 2026-08-29

What it asks of an app

Do not treat personal data scraped from an aggregator, people-search site, or re-hosted directory as publicly available under the Colorado Privacy Act; the exemption reaches only a government record or the consumer's own disclosure.
Track biometric data (a usable identifier) and biometric identifier (the raw measured characteristic) as two separate defined terms, at Section 6-1-1303(2.2) and (2.4) respectively.
Treat a scraped photo or voice recording as sensitive data, requiring opt-in consent, once you process it into a template used to identify a specific individual, even though the raw file alone is excluded from biometric data.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

What we found

Section 6-1-1303(17) excludes publicly available information from personal data, defined with only two prongs: information lawfully made available from a federal, state, or local government record, and information the controller has a reasonable basis to believe the consumer has lawfully made available to the general public.

Unlike California's CCPA, there is no third widely-distributed-media catch-all and no prong for information a third party disclosed without restricting the audience, so personal data a scraper pulls from a source that is neither a government record nor the data subject's own post, such as an aggregator or people-search broker, falls outside the exemption and inside the Act's reach for a qualifying collector.

HB 24-1130 (2024), effective July 1, 2025, added Section 6-1-1303(2.2), defining biometric data as one or more biometric identifiers used for identification purposes and excluding a bare digital or physical photograph, an audio or video recording, or data generated from one, unless used for identification; and (2.4), a separate term, biometric identifier, meaning data generated by measuring a person's unique biological, physical, or behavioral characteristics, such as a fingerprint, voiceprint, retina or iris scan, or facial geometry.

Biometric or genetic data processed to uniquely identify an individual is sensitive data under Section 6-1-1303(24)(b), triggering opt-in consent; scraping a raw photo or voice clip is not itself scraping biometric data, but processing it into an identification template is.

Primary source

official signed act PDFs, Colorado General Assembly (content.leg.colorado.gov and leg.colorado.gov)
the Colorado Attorney General's page (coag.gov) independently confirms the publicly-available definition

← Back to the example · Lint your app →