United States of America: Signed Bill on Privacy Protections for Children's Online Data (SB 24-041)

On 31 May 2024, the Bill on Privacy Protections for Children's Online Data (SB 24-041), amending the Colorado Privacy Act (SB 24-041), was signed into law by the Governor of Colorado. The Bill amends existing laws to include additional data protections for minors' online activity. The Bill mandates controllers who conduct business in Colorado or deliver products or services targeted at Colorado residents to minimise the risk of harm to minors. It requires a data protection assessment for any online service, product, or feature known or presumed to be used by minors, alongside maintaining documentation of such assessments. The Bill prohibits the processing of a minor's personal data for targeted advertising, the sale of personal data, or the profiling of minors without consent. Furthermore, the Act restricts the collection of a minor's precise geolocation data under specified circumstances. The enforcement of these requirements falls under the jurisdiction of the attorney general and district attorneys, in alignment with the Colorado Privacy Act. The Act will come into force on 1 October 2025 if no referendum petition is filed.