Law note · Colorado
SB 24-041, Protecting Minors' Online Data
Amends the Colorado Privacy Act to add a duty of care: a controller that offers an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor must use reasonable care to avoid a heightened risk of harm to that minor, and must complete a data protection assessment where that risk exists.
Absent opt-in consent (from the minor, or a parent or guardian for a minor under 13), the controller may not process a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects, use a system design feature meant to significantly increase, sustain, or extend a minor's use of the service, or collect a minor's precise geolocation data beyond what is necessary to provide the service.
The minors' provisions keep their own 60-day cure notice requirement in force through December 31, 2026, after the CPA's general cure period sunset on January 1, 2025.
What it asks of an app
- If you offer an online service, product, or feature that you actually know or willfully disregard is used by a minor, use reasonable care to avoid a heightened risk of harm to that minor, and complete a data protection assessment where that risk exists.
- Get opt-in consent, parental consent for a minor under 13, before processing a minor's personal data for targeted advertising, sale, or profiling with legal or similarly significant effects.
- Do not collect a minor's precise geolocation data beyond what is necessary to provide the service, and do not use a design feature meant to significantly increase, sustain, or extend a minor's use of the service without consent.
When LexLint raises it
Declared activities: deploys_chatbot, automated_outreach, high_risk_decisions, crawls_web
Primary source: Official enrolled act text, 2024 Colo. Sess. Laws ch. 296 (SB 24-041), and the Colorado General Assembly's official bill page