Law note · Colorado
HB 24-1130, Privacy of Biometric Identifiers and Data
Amends the Colorado Privacy Act to define biometric identifier (a fingerprint, a voiceprint, a scan or record of an eye retina or iris, a facial map, facial geometry, or facial template, or another unique biological, physical, or behavioral pattern) and biometric data, and adds C.R.S. 6-1-1314, which requires any controller that controls or processes a biometric identifier, regardless of the CPA's general size thresholds, to give notice and obtain consent before collection, adopt a written retention and destruction policy, maintain a data-security-incident response protocol, and refrain from selling, leasing, or trading a biometric identifier absent consent or a listed exception.
Consumers may request the source, purpose, and third-party disclosures of their biometric data. The biometric-data definition excludes a photograph and an audio or video recording, and data generated from either, but only conditionally: the exclusion drops away the moment that data is used for identification purposes, so a voiceprint or faceprint extracted from a recording specifically to identify someone remains covered.
What it asks of an app
- Before collecting a Colorado resident's biometric identifier such as a fingerprint, voiceprint, or facial geometry template, disclose in a clear and accessible manner what is collected, why, and how long it will be kept, and obtain the consumer's consent, whatever your app's overall personal-data processing volume.
- Adopt and publish a written policy that sets a retention schedule and a destruction timeline (the earliest of purpose satisfied, 24 months after the consumer's last interaction, or 45 days, extendable by up to 45 more, after the identifier is no longer needed) and a data-security-incident response protocol.
- Do not sell, lease, or trade a biometric identifier, or disclose one to a third party, without the consumer's consent or a listed statutory exception.
- A voiceprint or facial template you generate from a photo, audio, or video recording for the purpose of identifying someone is covered biometric data even though the underlying photo or recording itself is excluded when not used that way.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web
Primary source: official legislature bill status page for HB 24-1130 (bill history and staff summary)
the enrolled act PDF at leg.colorado.gov/bill_files/42280/download carries the definitional text quoted in the pins