United States of America: Act on Privacy Protections for Children's Online Data enters into force (Bill No. SB 24-041)

On 1 October 2025, the Act on Protections for Children's Online Data, amending the Colorado Privacy Act (SB 24-041), enters into force. The Act amends existing laws to include additional data protections for minors' online activity. The Act mandates controllers who conduct business in Colorado or deliver products or services targeted at Colorado residents to minimise the risk of harm to minors. It requires a data protection assessment for any online service, product, or feature known or presumed to be used by minors, alongside maintaining documentation of such assessments. The Act prohibits the processing of a minor's personal data for targeted advertising, the sale of personal data, or the profiling of minors without consent. Furthermore, the Act restricts the collection of a minor's precise geolocation data under specified circumstances. The enforcement of these requirements falls under the jurisdiction of the attorney general and district attorneys, in alignment with the Colorado Privacy Act.