House Committee of Reference Report
Committee on Business Affairs & Labor
-
All text that will be removed from the bill will be indicated by strikethrough as follows:
-
This is text that is removed from law. -
Text that is added to a bill will be indicated by either all capitals or bold & italic as follows:
-
- This all capitals text would be added to law.
- This is bold & italic text that would be added to law.
April 23, 2026
After consideration on the merits, the Committee recommends the following:
SB26-051 be amended as follows, and as so amended, be referred to the Committee of the Whole with favorable recommendation:
Page 1, Line 1Amend reengrossed bill, strike everything below the enacting clause and
Page 1, Line 2substitute:
Page 1, Line 3"SECTION 1. Legislative declaration. (1) The general
Page 1, Line 4assembly finds and declares that:
Page 1, Line 5(a) The state of Colorado has established a comprehensive
Page 1, Line 6framework for consumer data privacy through the enactment of the
Page 1, Line 7"Colorado Privacy Act", part 13 of article 1 of title 6, Colorado Revised
Page 1, Line 8Statutes, which recognizes that the personal data of minors requires
Page 1, Line 9heightened protections;
Page 1, Line 10(b) Under the "Colorado Privacy Act", controllers that process the
Page 1, Line 11personal data of minors are subject to additional obligations, including
Page 1, Line 12heightened duties related to data processing, targeted advertising, and
Page 1, Line 13profiling;
Page 1, Line 14(c) In practice, many applications and online services lack reliable
Page 1, Line 15information about whether a user is a minor, which limits their ability to
Page 1, Line 16comply with these legal obligations and to implement appropriate
Page 1, Line 17safeguards;
Page 1, Line 18(d) As a result, minors may be exposed to harmful design features
Page 1, Line 19or the collection and use of personal data in ways that are inconsistent
Page 1, Line 20with the protections contemplated by Colorado law; and
Page 1, Line 21(e) A mechanism that allows a computing device to provide a
Page 1, Line 22minimal age-category signal to applications can enable compliance with
Page 1, Line 23these obligations while minimizing the collection and retention of
Page 1, Line 24personal data.
Page 1, Line 25(2) Therefore, with this act, the general assembly intends to
Page 1, Line 26establish a framework for age attestation that enables age-appropriate
Page 1, Line 27protections while preserving user choice and appropriate parental
Page 2, Line 1involvement and avoiding the need for invasive identity verification
Page 2, Line 2methods.
Page 2, Line 3SECTION 2. In Colorado Revised Statutes, add article 30 to title
Page 2, Line 46 as follows:
Page 2, Line 5ARTICLE 30
Page 2, Line 6Age Attestation for Online Users
Page 2, Line 76-30-101. Definitions.
Page 2, Line 8As used in this article 30, unless the context otherwise
Page 2, Line 9requires:
Page 2, Line 10(1) "Account" means a user account that connects an
Page 2, Line 11operating system to a covered application store.
Page 2, Line 12(2) (a) "Account holder" means an individual in the state
Page 2, Line 13who is at least eighteen years old, or the parent or legal
Page 2, Line 14guardian of a user who is a minor, and who establishes an
Page 2, Line 15account on a device.
Page 2, Line 16(b) "Account holder" does not include a parent of an
Page 2, Line 17emancipated minor who is a user of a device.
Page 2, Line 18(3) "Age-bracket data" means nonpersonally identifiable
Page 2, Line 19data derived from a user's birth date or age for the purpose of
Page 2, Line 20sharing with covered applications, which data indicates the
Page 2, Line 21user's age range, including, at a minimum, data that indicates
Page 2, Line 22whether a user is:
Page 2, Line 23(a) Under thirteen years old;
Page 2, Line 24(b) Thirteen years old or older but under sixteen years
Page 2, Line 25old;
Page 2, Line 26(c) Sixteen years old or older but under eighteen years
Page 2, Line 27old; or
Page 2, Line 28(d) Eighteen years old or older.
Page 2, Line 29(4) "Age signal" means age-bracket data sent through a
Page 2, Line 30real-time secure application programming interface from an
Page 2, Line 31operating system or covered application store to a covered
Page 2, Line 32application.
Page 2, Line 33(5) (a) "Covered application" means a consumer software
Page 2, Line 34application that is accessed through a covered application store
Page 2, Line 35and that may be run or directed by a user on a device.
Page 2, Line 36(b) "Covered application" does not include:
Page 2, Line 37(I) A software application that does not process users'
Page 2, Line 38personal data; or
Page 2, Line 39(II) An application from a free, publicly available code
Page 2, Line 40repository.
Page 2, Line 41(6) (a) "Covered application store" means a publicly
Page 2, Line 42available internet website, software application, online service,
Page 2, Line 43or platform that distributes and facilitates, on a commercial
Page 3, Line 1basis, the download of applications from third-party developers
Page 3, Line 2to users of devices.
Page 3, Line 3(b) "Covered application store" does not include:
Page 3, Line 4(I) A code repository provider;
Page 3, Line 5(II) A containerized software distribution; or
Page 3, Line 6(III) An online service or platform that distributes any of
Page 3, Line 7the following applications if the application runs exclusively
Page 3, Line 8within a separate host application:
Page 3, Line 9(A) An extension;
Page 3, Line 10(B) A plug-in;
Page 3, Line 11(C) An add-on; or
Page 3, Line 12(D) Any other software application.
Page 3, Line 13(7) "Developer" means a person that writes, creates,
Page 3, Line 14maintains, or controls a covered application.
Page 3, Line 15(8) "Device" means a computer, mobile device, or similar
Page 3, Line 16general-purpose computing device that is intended for use by a
Page 3, Line 17consumer.
Page 3, Line 18(9) "Family account application" means a covered
Page 3, Line 19application that:
Page 3, Line 20(a) Offers subaccounts or profiles within the application;
Page 3, Line 21(b) Requires a paid subscription or account creation with
Page 3, Line 22payment method verification as the application's primary
Page 3, Line 23business model;
Page 3, Line 24(c) Does not permit account creation by minors; and
Page 3, Line 25(d) Verifies that the primary account holder for the
Page 3, Line 26application is over the age of eighteen years old using
Page 3, Line 27commercially reasonable age estimation methods.
Page 3, Line 28(10) "Minor" means an individual who is under eighteen
Page 3, Line 29years old.
Page 3, Line 30(11) "Operating system provider" means a person that
Page 3, Line 31develops, licenses, or controls the operating system software
Page 3, Line 32on a device.
Page 3, Line 33(12) "Personal data" has the meaning set forth in section
Page 3, Line 346-1-1303 (17).
Page 3, Line 35(13) "Process" has the meaning set forth in section
Page 3, Line 366-1-1303 (18).
Page 3, Line 37(14) "User" means the primary user of a device.
Page 3, Line 386-30-102. Requirements for operating system providers and
Page 3, Line 39developers.
Page 3, Line 40(1) On and after July 1, 2028, an operating system provider
Page 3, Line 41that operates a covered application store or makes a covered
Page 3, Line 42application store available pre-installed on an operating
Page 3, Line 43system shall provide an accessible interface at account setup
Page 4, Line 1that requires an account holder to indicate the birth date, age,
Page 4, Line 2or age bracket of the user of that device for the purpose of
Page 4, Line 3providing an age signal to covered applications available in the
Page 4, Line 4operating system provider's covered application store.
Page 4, Line 5Operating system providers may minimize the use of personal
Page 4, Line 6data by allowing an account holder to select an age bracket
Page 4, Line 7for a user who is eighteen years old or older without providing
Page 4, Line 8a birth date or age.
Page 4, Line 9(2) On and after July 1, 2028, an operating system provider
Page 4, Line 10or a covered application store shall:
Page 4, Line 11(a) Provide developers with a reasonably consistent,
Page 4, Line 12real-time application programming interface to request and
Page 4, Line 13receive an age signal; and
Page 4, Line 14(b) Send only the minimum amount of information
Page 4, Line 15necessary to comply with this article 30. An operating system
Page 4, Line 16provider or covered application store shall not share an age
Page 4, Line 17signal with a third party for a purpose not required by this
Page 4, Line 18article 30.
Page 4, Line 19(3) (a) A covered application must use the application
Page 4, Line 20programming interface provided by the operating system
Page 4, Line 21provider or covered application store to:
Page 4, Line 22(I) Request an age signal with respect to a particular user
Page 4, Line 23when the application is initially launched; and
Page 4, Line 24(II) Update the user's age bracket data as needed.
Page 4, Line 25(b) (I) A covered application that receives an age signal
Page 4, Line 26is deemed to have knowledge of the age range of the user to
Page 4, Line 27whom the signal pertains across all platforms and points of
Page 4, Line 28access of the covered application.
Page 4, Line 29(II) A developer shall not willfully disregard clear and
Page 4, Line 30convincing information that indicates that a user's age is
Page 4, Line 31different than the age-bracket data indicated by an age signal
Page 4, Line 32provided by an operating system provider or by a covered
Page 4, Line 33application store.
Page 4, Line 34(III) If a developer has clear and convincing information
Page 4, Line 35that a user's age is different than the age indicated by an age
Page 4, Line 36signal received pursuant to this article 30, the developer shall
Page 4, Line 37use that information as the primary indicator of the user's age.
Page 4, Line 38(IV) Except as provided in subsections (3)(b)(II) and
Page 4, Line 39(3)(b)(III) of this section, a developer shall treat an age signal
Page 4, Line 40received pursuant to this article 30 as the primary indicator of
Page 4, Line 41a user's age range.
Page 4, Line 42(V) Nothing in this section requires a developer to acquire
Page 4, Line 43age-related data other than an age signal.
Page 5, Line 1(c) A developer shall ensure that a covered application
Page 5, Line 2that receives an age signal pursuant to this article 30 uses the
Page 5, Line 3age signal only to comply with applicable law.
Page 5, Line 4(d) A developer shall ensure that a covered application
Page 5, Line 5that receives an age signal pursuant to this article 30 does not:
Page 5, Line 6(I) Request more information concerning the user from an
Page 5, Line 7operating system provider or a covered application store than
Page 5, Line 8the minimum amount of information necessary to comply with
Page 5, Line 9this article 30; or
Page 5, Line 10(II) Communicate the age signal to a third party for a
Page 5, Line 11purpose not required by this article 30.
Page 5, Line 12(e) Notwithstanding subsections (3)(a)(I) and (3)(b)(IV) of
Page 5, Line 13this section, a developer of a family account application may:
Page 5, Line 14 (I) Use the age of the primary account holder of a family
Page 5, Line 15account application as the age of a user for purposes of applying
Page 5, Line 16age-related safety defaults and access to features within the
Page 5, Line 17family account application; and
Page 5, Line 18(II) Allow the primary account holder of a family
Page 5, Line 19account application to attest to the age of the users of
Page 5, Line 20subaccounts of the family account application.
Page 5, Line 216-30-103. Applicability to existing devices.
Page 5, Line 22(1) With respect to a device for which account setup was
Page 5, Line 23completed before July 1, 2028, an operating system provider
Page 5, Line 24shall provide, before January 1, 2029, an accessible interface
Page 5, Line 25that allows an account holder to indicate the birth date or age
Page 5, Line 26of the user of that device for the purpose of providing an age
Page 5, Line 27signal regarding the user's age-bracket data to covered
Page 5, Line 28applications available in a covered application store.
Page 5, Line 29(2) If a covered application last updated on or after July
Page 5, Line 301, 2027, was downloaded to a device before July 1, 2028, and the
Page 5, Line 31covered application has not requested an age signal with
Page 5, Line 32respect to the user of the device on which the covered
Page 5, Line 33application was downloaded, the covered application must
Page 5, Line 34request an age signal from the covered application store from
Page 5, Line 35which the covered application was downloaded with respect to
Page 5, Line 36that user before January 1, 2029.
Page 5, Line 376-30-104. Enforcement - penalties.
Page 5, Line 38(1) A person that violates this article 30 shall pay a civil
Page 5, Line 39penalty of no more than two thousand five hundred dollars for
Page 5, Line 40each minor harmed by each negligent violation or no more than
Page 5, Line 41seven thousand five hundred dollars for each minor harmed by
Page 5, Line 42each intentional violation. The attorney general shall assess
Page 5, Line 43and recover the penalty in a civil action.
Page 6, Line 1(2) Notwithstanding subsection (1) of this section, if an
Page 6, Line 2operating system provider or a covered application store makes
Page 6, Line 3a good faith effort to comply with this article 30, taking into
Page 6, Line 4consideration available technology and any reasonable
Page 6, Line 5technical limitations or outages, the operating system provider
Page 6, Line 6or covered application store is not liable for an erroneous age
Page 6, Line 7signal indicating a user's age range or for conduct by a covered
Page 6, Line 8application that receives an age signal indicating a user's age
Page 6, Line 9range.
Page 6, Line 106-30-105. Applicability - limitations.
Page 6, Line 11(1) This article 30 does not:
Page 6, Line 12(a) Modify, impair, or supersede any antitrust law,
Page 6, Line 13including the "Colorado State Antitrust Act of 2023", article
Page 6, Line 144 of this title 6; or
Page 6, Line 15(b) Require the collection of additional personal data
Page 6, Line 16from device owners or device users that is not necessary to
Page 6, Line 17comply with this article 30.
Page 6, Line 18(2) An operating system provider or covered application
Page 6, Line 19store shall not discriminate in complying with this article 30.
Page 6, Line 20Discrimination in complying with this article 30 includes:
Page 6, Line 21(a) Imposing less stringent restrictions and obligations on
Page 6, Line 22its own applications and application distribution than it does on
Page 6, Line 23those from third-party applications or application distributors;
Page 6, Line 24or
Page 6, Line 25(b) Using nonpublicly available data collected from a
Page 6, Line 26third party in the course of compliance with this article 30 to
Page 6, Line 27compete against that third party, give the covered application
Page 6, Line 28store's services preference relative to those of a third party, or
Page 6, Line 29use the nonpublicly available data in an anticompetitive manner
Page 6, Line 30in violation of applicable law.
Page 6, Line 31(3) This article 30 does not apply to:
Page 6, Line 32(a) A broadband internet access service, as defined in
Page 6, Line 33section 40-15-209 (4)(a);
Page 6, Line 34(b) A telecommunications service, as defined in 47 U.S.C.
Page 6, Line 35sec. 153 (53);
Page 6, Line 36(c) The delivery of or use of a physical product;
Page 6, Line 37(d) Data maintained by a state institution of higher
Page 6, Line 38education, as defined in section 23-18-102 (10), the state, a
Page 6, Line 39subdivision of the state, the judicial department of the state, or
Page 6, Line 40a county, city and county, or municipality if the data is
Page 6, Line 41collected, maintained, disclosed, communicated, and used as
Page 6, Line 42authorized by state and federal law for noncommercial
Page 6, Line 43purposes; or
Page 7, Line 1(e) An operating system provider or developer that
Page 7, Line 2distributes an operating system or application under license
Page 7, Line 3terms that permit a recipient to copy, redistribute, and modify
Page 7, Line 4the software without restriction from the provider or
Page 7, Line 5developer, including any technical or contractual restrictions
Page 7, Line 6on installing all modified versions.
Page 7, Line 7(4) This article 30 does not impose liability that arises
Page 7, Line 8from the use of a device or application by an individual who is
Page 7, Line 9not the user to whom an age signal pertains on an operating
Page 7, Line 10system provider, a covered application store, or a developer.
Page 7, Line 11(5) Notwithstanding any provision of this article 30 to the
Page 7, Line 12contrary, this article 30 does not apply to a developer if the
Page 7, Line 13predominant or exclusive function of the covered application
Page 7, Line 14that the developer writes, creates, maintains, or controls is:
Page 7, Line 15(a) Facilitating communication within a business or an
Page 7, Line 16enterprise among employees or affiliates of the business or
Page 7, Line 17enterprise, so long as access to the covered application is
Page 7, Line 18restricted to employees or affiliates of the business or
Page 7, Line 19enterprise;
Page 7, Line 20(b) Providing enterprise software functions used by
Page 7, Line 21businesses, governments, or nonprofit organizations; or
Page 7, Line 22(c) Providing or obtaining technical support for a
Page 7, Line 23software platform, product, or service.
Page 7, Line 24SECTION 2. Act subject to petition - effective date. This act
Page 7, Line 25takes effect July 1, 2028; except that, if a referendum petition is filed
Page 7, Line 26pursuant to section 1 (3) of article V of the state constitution against this
Page 7, Line 27act or an item, section, or part of this act within the ninety-day period
Page 7, Line 28after final adjournment of the general assembly, then the act, item,
Page 7, Line 29section, or part will not take effect unless approved by the people at the
Page 7, Line 30general election to be held in November 2026 and, in such case, will take
Page 7, Line 31effect July 1, 2028.".