United States of America: Adopted Attorney General amendments to Colorado Privacy Act Rules (CPA) for biometric privacy and children's privacy

On 6 December 2024, the Colorado Attorney General (AG) announced the adoption of amendments to the Colorado Privacy Act (CPA), reflecting updates introduced by HB 24-1130 (Biometric Privacy) and SB 24-041 (Children’s Privacy), both signed into law by the Governor on 31 May 2024. The amendments require data controllers to clearly notify consumers before collecting or processing biometric identifiers and for employers to obtain consent from employees before processing their biometric data. Selling, leasing, or trading biometric data is prohibited without consumer consent. For children’s privacy, controllers must obtain valid consent before processing minors' data or using systems designed to increase their engagement, and entities processing minors’ data must complete data protection assessments. The amendments also introduce a process for the AG to issue opinion letters and interpretive guidance to support compliance. The rules await final administrative steps, including filing with the Secretary of State, and will take effect 30 days after publication in the state register.