Law note · Colorado
HB 24-1058, Protect Privacy of Biological Data
cite C.R.S. sections 6-1-1303(2.5), 6-1-1303(16.7), 6-1-1303(24)(b)-(d) (2024 Colo. Sess. Laws ch. 68)
stage In effect
since 2024-08-07
reviewed 2026-08-23
Amends the Colorado Privacy Act's sensitive-data definition to add biological data (data from technological processing, measurement, or analysis of an individual's biological, genetic, biochemical, physiological, or neural properties, used or intended for identification) and neural data (information generated by measuring central or peripheral nervous system activity, processed by or with a device).
Extends the CPA's opt-in consent duty for sensitive data to both categories, the first such extension to neural data in a US comprehensive privacy statute.
What it asks of an app
- Treat data generated by measuring an individual's biological, genetic, biochemical, physiological, or neural properties, or central or peripheral nervous system activity, as sensitive data requiring the consumer's affirmative opt-in consent before you process it.
When LexLint raises it
Declared activities: processes_biometrics
Primary source: Colorado General Assembly official bill page for HB24-1058