A Bill for an Act
Page 1, Line 101Concerning prohibiting a government entity from obtaining
Page 1, Line 102certain personal data from a third party for use by a
Page 1, Line 103government entity in exchange for anything of value.
Bill Summary
(Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.)
The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves.
Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety.
The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.
Page 2, Line 1Be it enacted by the General Assembly of the State of Colorado:
Page 2, Line 2SECTION 1. Short title. The short title of this act is the "Fourth
Page 2, Line 3Amendment is Not for Sale Act".
Page 2, Line 4SECTION 2. Legislative declaration. (1) The general assembly
Page 2, Line 5finds and declares that:
Page 2, Line 6(a) The fourth amendment to the United States constitution
Page 2, Line 7guarantees that "[t]he right of the people to be secure in their persons,
Page 2, Line 8houses, papers, and effects, against unreasonable searches and seizures,
Page 2, Line 9shall not be violated, and no Warrants shall issue, but upon probable
Page 2, Line 10cause, supported by Oath or affirmation, and particularly describing the
Page 2, Line 11place to be searched, and the persons or things to be seized";
Page 2, Line 12(b) The United States supreme court has observed, "Few
Page 2, Line 13protections are as essential to individual liberty as the right to be free
Page 2, Line 14from unreasonable searches and seizures. The Framers made that right
Page 2, Line 15explicit in the Bill of Rights following their experience with the
Page 2, Line 16indignities and invasions of privacy wrought by general warrants and
Page 2, Line 17warrantless searches that had so alienated the colonists and had helped
Page 2, Line 18speed the movement for independence. Ever mindful of the Fourth
Page 2, Line 19Amendment and its history, the Court has viewed with disfavor practices
Page 2, Line 20that permit police officers unbridled discretion to rummage at will among
Page 2, Line 21a person's private effects." Byrd v. United States, 584 U.S. 395, 402-403
Page 3, Line 1(2018). Accordingly, "As technology has enhanced the Government's
Page 3, Line 2capacity to encroach upon areas normally guarded from inquisitive eyes,
Page 3, Line 3[the United States Supreme] Court has sought to assure preservation of
Page 3, Line 4that degree of privacy against government that existed when the Fourth
Page 3, Line 5Amendment was adopted." Carpenter v. United States, 585 U.S. 296, 305
Page 3, Line 6(2018).
Page 3, Line 7(c) In People v. Seymour, 536 P.3d 1260 (Colo. 2023), the
Page 3, Line 8Colorado supreme court stated that Colorado is not bound by the United
Page 3, Line 9States supreme court's interpretation of the fourth amendment when
Page 3, Line 10determining the scope of state constitutional protections. The court stated
Page 3, Line 11that article II, section 7 provides even greater privacy protections than the
Page 3, Line 12fourth amendment, and Colorado has "long rejected the third-party
Page 3, Line 13doctrine under that provision of the Colorado Constitution," further
Page 3, Line 14stating that "[g]iven the enduring and related privacy concerns presented
Page 3, Line 15by a search of an individual's online search history, we see no reason to
Page 3, Line 16change course here."
Page 3, Line 17(d) Law enforcement has been able to effectively and efficiently
Page 3, Line 18enforce our criminal laws for more than 230 years without needing to
Page 3, Line 19evade fourth amendment warrant requirements that are essential to
Page 3, Line 20protecting Americans' liberty and privacy in the digital age.
Page 3, Line 21SECTION 3. In Colorado Revised Statutes, add 16-3-303.3 as
Page 3, Line 22follows:
Page 3, Line 2316-3-303.3. Prohibition on the bulk purchase of data from
Page 3, Line 24third parties by law enforcement - evidence inadmissible in court -
Page 3, Line 25definitions.
Page 3, Line 26(1) As used in this section, unless the context otherwise
Page 3, Line 27requires:
Page 4, Line 1(a) "Exchange for anything of value" means to obtain or
Page 4, Line 2receive access to an item, data, or information:
Page 4, Line 3(I) In exchange for money or other valuable
Page 4, Line 4consideration;
Page 4, Line 5(II) In connection with services or benefits provided as
Page 4, Line 6consideration; or
Page 4, Line 7(III) As part of the provision of a fee, including an access
Page 4, Line 8fee, service fee, maintenance fee, or licensing fee.
Page 4, Line 9(b) "Government entity" has the same meaning set forth
Page 4, Line 10in section 16-3-303.5, including a political subdivision.
Page 4, Line 11(c) "Law enforcement entity" means an agency or other
Page 4, Line 12instrumentality of a government entity, including an employee
Page 4, Line 13or agent of the entity, that is authorized by law, regulation, or
Page 4, Line 14governmental policy to engage in or supervise the prevention,
Page 4, Line 15detection, investigation, or prosecution of a violation of
Page 4, Line 16criminal law.
Page 4, Line 17(d) "Personal data" means information collected from or
Page 4, Line 18generated by a specific person as part of a consumer transaction
Page 4, Line 19or the use of a consumer product or service, whether the
Page 4, Line 20information was collected by the original third party or
Page 4, Line 21obtained by a different third party, that is connected or
Page 4, Line 22reasonably connected to the specific person or the specific
Page 4, Line 23person's electronic device. Personal data includes, but is not
Page 4, Line 24limited to, a person's:
Page 4, Line 25(I) Name;
Page 4, Line 26(II) Billing information or address;
Page 4, Line 27(III) Social security number;
Page 5, Line 1(IV) Home address;
Page 5, Line 2(V) Demographic data;
Page 5, Line 3(VI) Web browsing or search history;
Page 5, Line 4(VII) Application usage history;
Page 5, Line 5(VIII) Precise geolocation data, as defined in section
Page 5, Line 66-1-1303;
Page 5, Line 7(IX) Financial information;
Page 5, Line 8(X) Health information;
Page 5, Line 9(XI) Biometric identifier, as defined in section 6-1-1303;
Page 5, Line 10(XII) Biological data, as defined in section 6-1-1303;
Page 5, Line 11(XIII) Characteristics of protected classifications under
Page 5, Line 12state or federal law;
Page 5, Line 13(XIV) Device identifier, including a media access control
Page 5, Line 14address, international mobile equipment identifier, or internet
Page 5, Line 15protocol address;
Page 5, Line 16(XV) Communications content; and
Page 5, Line 17(XVI) Profiles or inferences about an individual based on
Page 5, Line 18data points collected or acquired from third parties.
Page 5, Line 19(e) "Third party" means a person who:
Page 5, Line 20(I) Is not a government entity; and
Page 5, Line 21(II) Is not the person to whom the personal data pertains.
Page 5, Line 22(f) "Widely distributed media" means content that is made
Page 5, Line 23available to a large, general audience through channels that
Page 5, Line 24allow broad access and regular dissemination, as opposed to
Page 5, Line 25private, niche, or restricted communications.
Page 5, Line 26(2) In connection with a criminal, civil, or other
Page 5, Line 27investigatory or enforcement activity:
Page 6, Line 1(a) A law enforcement entity shall not obtain or receive
Page 6, Line 2access to an individual's personal data from a third party in
Page 6, Line 3exchange for anything of value;
Page 6, Line 4(b) A law enforcement entity shall not request, obtain, or
Page 6, Line 5receive access to an individual's personal data from a federal,
Page 6, Line 6state, or local law enforcement or other government agency or
Page 6, Line 7department if the data was obtained from a third party in
Page 6, Line 8exchange for anything of value;
Page 6, Line 9(c) A law enforcement entity shall not share on a
Page 6, Line 10third-party platform or sell, in exchange for anything of value,
Page 6, Line 11an individual's personal data to a federal, state, or local law
Page 6, Line 12enforcement or other government agency or department, or a
Page 6, Line 13third party if the personal data was directly or indirectly
Page 6, Line 14collected by the law enforcement agency; and
Page 6, Line 15(d) A government entity, including a law enforcement
Page 6, Line 16entity, shall not provide or share with a federal, state, or local
Page 6, Line 17law enforcement agency or department an individual's personal
Page 6, Line 18data obtained from a third party in exchange for anything of
Page 6, Line 19value.
Page 6, Line 20(3) Subsection (2) of this section does not apply when:
Page 6, Line 21(a) A law enforcement entity has obtained a valid judicial
Page 6, Line 22warrant, subpoena, or court order, and any accompanying
Page 6, Line 23affidavit to each party, pursuant to rule 16 of the Colorado
Page 6, Line 24rules of criminal procedure, or any successor rule, for the
Page 6, Line 25personal data of the specifically identified individual;
Page 6, Line 26(b) The law enforcement entity asserts in good faith that
Page 6, Line 27an emergency situation exists that involves the risk of death or
Page 7, Line 1serious bodily injury to a person that requires immediate
Page 7, Line 2disclosure;
Page 7, Line 3(c) The personal data is lawfully available to the public
Page 7, Line 4through government records or widely distributed media;
Page 7, Line 5(d) The personal data pertains to a specific individual, was
Page 7, Line 6voluntarily made available to the public by the specific
Page 7, Line 7individual, and was obtained in compliance with all applicable
Page 7, Line 8laws, regulations, contracts, privacy policies, and terms of
Page 7, Line 9service;
Page 7, Line 10(e) The specific individual to whom the personal data
Page 7, Line 11pertains intended law enforcement to be a recipient of the
Page 7, Line 12personal data, as evidenced by case-specific, express consent
Page 7, Line 13from the specific individual;
Page 7, Line 14(f) The third party providing the personal data was
Page 7, Line 15authorized by the specific individual to whom the personal data
Page 7, Line 16pertains to provide the data to the law enforcement entity, as
Page 7, Line 17evidenced by case-specific, express consent from the specific
Page 7, Line 18individual; or
Page 7, Line 19(g) The personal data is provided to or by the national
Page 7, Line 20center for missing and exploited children or its successor entity
Page 7, Line 21and is related to an investigation involving a missing or
Page 7, Line 22exploited child.
Page 7, Line 23(4) Subsections (3)(d) to (3)(f) of this section do not
Page 7, Line 24violate subsection (2) of this section if the person made their
Page 7, Line 25personal data publicly available, even if a law enforcement
Page 7, Line 26entity purchases the personal data from a third party.
Page 7, Line 27(5) (a) A violation of this section constitutes an injury,
Page 8, Line 1and a person who is injured may bring a legal action for
Page 8, Line 2injunctive relief, declaratory relief, or other relief deemed
Page 8, Line 3necessary to enforce this section in a court of competent
Page 8, Line 4jurisdiction. A plaintiff may seek reasonable attorney fees
Page 8, Line 5pursuant to this section.
Page 8, Line 6(b) (I) A court shall not admit personal data acquired in
Page 8, Line 7violation of this section or evidence derived from that
Page 8, Line 8information at a trial, hearing, or other proceeding unless the
Page 8, Line 9party seeking to introduce the evidence provides a copy of the
Page 8, Line 10valid judicial warrant, subpoena, or court order and any
Page 8, Line 11accompanying affidavit to each party pursuant to rule 16 of the
Page 8, Line 12Colorado rules of criminal procedure, or any successor rule.
Page 8, Line 13(II) A court may waive the requirement in subsection
Page 8, Line 14(5)(b)(I) of this section if the court finds that it was not possible
Page 8, Line 15to provide a party with the valid judicial warrant, subpoena, or
Page 8, Line 16court order and any accompanying application within the time
Page 8, Line 17required by rule 16 of the Colorado rules of criminal procedure,
Page 8, Line 18or any successor rule, and the court finds that the party will
Page 8, Line 19not be prejudiced by the delay in receiving the information.
Page 8, Line 20SECTION 4. In Colorado Revised Statutes, 16-3-303.5, add (9)
Page 8, Line 21as follows:
Page 8, Line 2216-3-303.5. Location information - search warrant required
Page 8, Line 23- definitions.
Page 8, Line 24(9) Nothing in this section authorizes a government entity
Page 8, Line 25to obtain location information of an electronic device in
Page 8, Line 26exchange for anything of value in violation of section
Page 8, Line 2716-3-303.3.
Page 9, Line 1SECTION 5. Safety clause. The general assembly finds,
Page 9, Line 2determines, and declares that this act is necessary for the immediate
Page 9, Line 3preservation of the public peace, health, or safety or for appropriations for
Page 9, Line 4the support and maintenance of the departments of the state and state
Page 9, Line 5institutions.