The Colorado biometric privacy law takes full effect on July 1, 2025, marking a major shift in how businesses must handle biometric data like fingerprints, facial scans, voiceprints, and iris images. With the passage of House Bill 24-1130, companies operating in Colorado must ensure full compliance with new rules that expand the Colorado Privacy Act (CPA) and treat biometric information as highly sensitive, non-replaceable personal data.
If your business uses biometric technology for timekeeping, security access, or authentication, this law directly affects you—even if you're exempt from other CPA rules. Here's what you need to know and how to get ready.
Who Must Comply With Colorado’s Biometric Privacy Law?
Unlike the general CPA, this law casts a wider net. Any business that collects, stores, or uses biometric identifiers from Colorado residents must comply, regardless of size or CPA coverage. This includes employers collecting biometric data from employees, contractors, job applicants, interns, and others.
Biometric identifiers include fingerprints, iris scans, voiceprints, and facial recognition data. The law also governs biometric data extracted from images, audio, or video files, especially when used for identification through AI tools like facial recognition or speech analytics. If your business uses such tools, you’re likely subject to the law.
Key Compliance Steps for Businesses
To comply with the Colorado biometric privacy law, businesses must follow five core requirements:
-
Written Biometric Policy
Create and maintain a clear, documented policy that outlines your data collection purpose, deletion schedule (no more than 24 months), and breach response plan. Internal-only policies for employee data don’t need to be public but must still be followed.
-
Clear Notice & Informed Consent
Before collecting biometric identifiers, provide individuals with notice detailing what data is collected, why, how long it will be stored, and whether it will be shared. Consent must be unambiguous, informed, and separate from general terms of service.
-
Limit Use & Sharing
The law bans the sale or trade of biometric data. Sharing is allowed only with consent, legal requirements, or when necessary for authorized transactions. Denying services for refusal to provide biometric data is prohibited unless it's essential to the service.
-
User Access Rights
If you fall under the CPA’s general thresholds, you must disclose what biometric data you’ve collected and with whom it was shared. If not, you’re still bound to follow all other biometric-specific provisions.
-
Strong Data Security
All biometric data must be protected using industry-standard security practices. Businesses must be ready to delete data on time and notify users of breaches as required.
How Colorado Businesses Can Prepare
With the July 1, 2025 deadline approaching, companies should immediately audit their current systems and vendor relationships. Employers should review their time clocks, surveillance systems, authentication methods, and HR platforms that collect biometric data. Ensure that all tools used align with employees’ roles and expectations and that internal staff is trained on handling and deleting biometric data correctly.
Update your privacy notices, secure separate biometric consents, and review contracts with processors to ensure downstream compliance. Failure to comply can lead to civil penalties and legal action from the Colorado Attorney General.
Comment