House Committee of Reference Report
Committee on Health & Human Services
- Strikethrough:
- removed from existing law
- Screen Reader Only:
- all text indicated as strikethrough will begin as 'deleted from existing statue' and finish with 'end deletion'
- All-caps or Bold and Italic:
- added to existing law
- Screen Reader Only:
- all text indicated as all-caps or bold and italic will begin as 'added to existing law' and finish with 'end insertion'
April 2, 2025
After consideration on the merits, the Committee recommends the following:
HB25-1287 be amended as follows, and as so amended, be referred to the Committee on Appropriations with favorable recommendation:
Page 1, Line 1Amend printed bill, page 4, strike lines 23 and 24 and substitute "or
Page 1, Line 2prospective Colorado user is:
Page 1, Line 3(a) A minor; or
Page 1, Line 4(b) A child for purposes of the "Children's Online Privacy
Page 1, Line 5Protection Act of 1998", 18 U.S.C. sec. 6501, et seq.
Page 1, Line 6(2) "Child" means an individual who is under thirteen
Page 1, Line 7years of age.
Page 1, Line 8(3) "Colorado minor user" or "minor user" means a
Page 1, Line 9Colorado resident who".
Page 1, Line 10Renumber succeeding subsections accordingly.
Page 1, Line 11Page 5, strike lines 22 and 23 and substitute:
Page 1, Line 12"(g) Engagement features such as comments, likes, tags,
Page 1, Line 13and other forms of feedback, including quantification of such
Page 1, Line 14features, regarding any item generated by a user; and".
Page 1, Line 15Page 6, strike lines 7 and 8 and substitute:
Page 1, Line 16"(11) "Personal data" has the meaning set forth in section
Page 1, Line 176-1-1303 (17).".
Page 1, Line 18Page 9, strike lines 23 through 26.
Page 1, Line 19Page 13, strike lines 25 and 26 and substitute "social media companies
Page 1, Line 20- review process - appeals - collection and retention of personal data
Page 1, Line 21restricted - effective date contingent upon certification of the attorney
Page 1, Line 22general - notice to the revisor of statutes. (1) A social media
Page 1, Line 23company shall implement an".
Page 2, Line 1Page 14, line 3, after "(2)" insert (a)".
Page 2, Line 2Page 14, strike lines 5 and 6 and substitute "use of an age assurance
Page 2, Line 3system with tools and safeguards for Colorado".
Page 2, Line 4Page 14, strike lines 8 through 23 and substitute "sections 6-1-1602,
Page 2, Line 56-1-1604, and 6-1-1605.
Page 2, Line 6(b) A social media company shall treat a Colorado user
Page 2, Line 7who does not participate in an age assurance system, or for
Page 2, Line 8whom an age assurance system does not result in a
Page 2, Line 9determination, as a minor user. A Colorado user who is deemed
Page 2, Line 10to be a minor user may appeal the determination through the
Page 2, Line 11review process described in subsection (3)(a) of this section.
Page 2, Line 12(3) (a) A social media company shall:
Page 2, Line 13(I) Implement a review process that allows a Colorado
Page 2, Line 14user to appeal the Colorado user's age designation by submitting
Page 2, Line 15information to establish the Colorado user's age within thirty
Page 2, Line 16days after the determination is made; and
Page 2, Line 17(II) Review information submitted by a Colorado user
Page 2, Line 18pursuant to subsection (3)(a)(I) of this section and make a
Page 2, Line 19determination within thirty days after the Colorado user's
Page 2, Line 20submission of the information.
Page 2, Line 21(b) Nothing in this section requires the use of
Page 2, Line 22government-issued identification.
Page 2, Line 23(4) A social media company shall:
Page 2, Line 24(a) Collect personal data of a Colorado user only as
Page 2, Line 25strictly necessary for age assurance;
Page 2, Line 26(b) Upon determining whether a Colorado user is a minor
Page 2, Line 27user, retain any personal data collected from the user for age
Page 2, Line 28assurance for no more than thirty days, solely for the purpose
Page 2, Line 29of evaluating an age determination appeal. If no appeal is
Page 2, Line 30submitted within thirty days, a social media company shall
Page 2, Line 31immediately delete any personal data collected from the user
Page 2, Line 32for age assurance, except the determination of whether the user
Page 2, Line 33is or is not a minor. If a user appeals an age determination using
Page 2, Line 34the process described in subsection (3)(a) of this section, a social
Page 2, Line 35media company shall retain any personal data collected from
Page 2, Line 36the user for age assurance for the sole purpose of evaluating
Page 2, Line 37the appeal within thirty days after its submission. After the
Page 2, Line 38determination of the appeal, a social media company shall
Page 2, Line 39immediately delete any personal data collected from the user
Page 2, Line 40for age assurance, except the determination of whether the user
Page 3, Line 1is a minor.
Page 3, Line 2(c) Segregate and not combine a Colorado user's personal
Page 3, Line 3data collected for age assurance with any other personal data
Page 3, Line 4of the user, except whether the user is or is not determined to be
Page 3, Line 5a minor; and
Page 3, Line 6(d) Not store or use any personal data of a Colorado user
Page 3, Line 7collected for age assurance for any other purpose except where
Page 3, Line 8necessary for compliance with any applicable provisions of state
Page 3, Line 9or federal law or regulation.
Page 3, Line 10(5) (a) Notwithstanding any provision of this section to
Page 3, Line 11the contrary, this section takes effect October 1, 2027; except
Page 3, Line 12that this section takes effect only if, on or before October 1,
Page 3, Line 132027, the attorney general certifies that neither a Colorado
Page 3, Line 14state court, the United States district court for the district of
Page 3, Line 15Colorado, the United States court of appeals for the tenth
Page 3, Line 16circuit, nor the United States supreme court has held, in a
Page 3, Line 17decision that has not been overturned or stayed and that
Page 3, Line 18otherwise remains law, that the use of an age assurance system
Page 3, Line 19as described in this part 16 violates the state constitution or
Page 3, Line 20the United States constitution. Nothing in this subsection (5)(a)
Page 3, Line 21precludes future action to conform to such a court decision if
Page 3, Line 22this certification cannot be provided.
Page 3, Line 23(b) If the attorney general makes a certification as
Page 3, Line 24described in subsection (5)(a) of this section, the attorney
Page 3, Line 25general shall notify the revisor of statutes in writing of the
Page 3, Line 26date when the certification has occurred by emailing the
Page 3, Line 27written notice to revisorofstatutes.ga@coleg.gov.".
Page 3, Line 28Page 15, line 11, strike "verifiable".
Page 3, Line 29Page 15, strike line 12 and substitute "in section 6-1-1308.5 (3)(a);
Page 3, Line 30and".
Page 3, Line 31Page 15, strike lines 18 through 27.
Page 3, Line 32Strike pages 16 and 17 and substitute:
Page 3, Line 33"6-1-1605. Colorado minor user accounts - requirements for".
Page 3, Line 34Renumber succeeding C.R.S. sections accordingly.
Page 3, Line 35Page 18, line 5, after "including" insert "applicable".
Page 3, Line 36Page 18, strike line 14.
Page 4, Line 1Page 18, strike lines 16 through 21 and substitute "disclosed; and
Page 4, Line 2(III) Includes a description of how all personalized
Page 4, Line 3recommendation systems are used by the social media company
Page 4, Line 4to provide information to minors and information regarding how
Page 4, Line 5minors or their parents can opt out of or control such systems;
Page 4, Line 6(c) Configure the following default settings:
Page 4, Line 7(I) Restrict public access to a user's personal data
Page 4, Line 8collected by or shared on the social media platform;
Page 4, Line 9(II) Disable search engine indexing of minor profiles or".
Page 4, Line 10Page 18, line 23, strike "(e)" and substitute "(III)".
Page 4, Line 11Page 18, line 25, strike "(f)" and substitute "(IV)".
Page 4, Line 12Page 19, strike line 1 and substitute:
Page 4, Line 13"(V) Restrict the visibility of information posted by a
Page 4, Line 14minor user so that it appears only to users with".
Page 4, Line 15Page 19, line 3, strike "(h)" and substitute "(VI)".
Page 4, Line 16Page 19, line 5, strike "(i)" and substitute "(VII)".
Page 4, Line 17Page 19, strike lines 7 and 8 and substitute "platform may contain the
Page 4, Line 18minor's geolocation information; and
Page 4, Line 19(VIII) Not display a minor user's location to other users
Page 4, Line 20unless the minor expressly and unambiguously shares their
Page 4, Line 21location with a specific user;
Page 4, Line 22(d) Allow a minor to download a file with all
Page 4, Line 23information".
Page 4, Line 24Page 19, line 10, strike "(k)" and substitute "(e)".
Page 4, Line 25Page 19, strike lines 15 through 27 and substitute:
Page 4, Line 26"(2) A social media company shall:
Page 4, Line 27(a) Configure all default settings for a minor user's
Page 4, Line 28account on the social media platform to the option available
Page 4, Line 29that provides the most protective level of privacy and security
Page 4, Line 30for the minor user; and
Page 4, Line 31(b) Not provide a minor user with a single setting that
Page 4, Line 32makes all of the default settings less protective at once.".
Page 4, Line 33Page 20, lines 4 and 5, strike "safeguards or parental tools," and
Page 4, Line 34substitute "safeguards,".
Page 5, Line 1Page 20, strike line 17 and substitute:
Page 5, Line 2"6-1-1608. Collection of personal data restricted. A social
Page 5, Line 3media platform shall collect personal data only as is
Page 5, Line 4reasonably necessary and proportionate to provide or maintain
Page 5, Line 5a specific product or service requested by the consumer to whom
Page 5, Line 6the data pertains.
Page 5, Line 76-1-1609. Violations - unfair or deceptive trade practice. A".
Page 5, Line 8Page 20, after line 20 insert:
Page 5, Line 9"6-1-1610. Nondiscrimination in applicability. Nothing in this
Page 5, Line 10part 16 may be construed to discriminate against a Colorado
Page 5, Line 11minor based on race, color, ethnicity, religion, sex, disability,
Page 5, Line 12sexual orientation, gender identity, gender expression, or
Page 5, Line 13national origin.".
Page 5, Line 14Renumber succeeding C.R.S. sections accordingly.
Page 5, Line 15Page 21, strike lines 8 and 9 and substitute:
Page 5, Line 16"6-1-1613. Rules. (1) The attorney general may adopt
Page 5, Line 17rules to implement this part 16, including rules:
Page 5, Line 18(a) Identifying age assurance systems that can determine
Page 5, Line 19whether a user is a Colorado minor;
Page 5, Line 20(b) Describing an appropriate review process for a user
Page 5, Line 21who appeals their age designation; and
Page 5, Line 22(c) Providing any additional privacy protections for age
Page 5, Line 23assurance data.
Page 5, Line 24(2) If the attorney general adopts rules pursuant to
Page 5, Line 25subsection (1) of this section, the attorney general shall
Page 5, Line 26periodically review and update the rules as necessary to keep
Page 5, Line 27pace with emerging technology.".
Page 5, Line 28Page 21, strike lines 18 and 19 substitute "6-1-1607, Colorado Revised
Page 5, Line 29Statutes, as added in section 2 of this act, takes effect October 1, 2025;
Page 5, Line 30section 6-1-1603, Colorado Revised Statutes, as added in section 2 of this
Page 5, Line 31act, takes effect October 1, 2027, only if the attorney general makes a
Page 5, Line 32certification on or before October 1, 2027, as described in section
Page 5, Line 336-1-1603 (5), and the remainder of this act takes effect at".