Starting July 1, 2025, businesses and employers in Colorado will face new legal obligations when collecting biometric data. That’s when House Bill 24-1130, a major expansion of the Colorado Privacy Act (CPA), comes into force – bringing with it some of the most detailed biometric data protections in the country.
The amended law applies to both consumer-facing businesses and employers that collect biometric identifiers from Colorado residents, including fingerprints, iris scans, and facial recognition data. It establishes requirements for notice, consent, data security, and deletion timelines that go beyond the general CPA framework.
“From fingerprint scanners to the facial recognition that unlocks our smartphones, our biometric data is intertwined with current and emerging technology. Biometric data is incredibly personal. This law ensures our biometric data is protected and stored safely, improving consumer protections and reducing the risk of our personal data being used improperly,” said Sen. Lindsey Daugherty, who introduced HB 24-1130 while serving in the House.
Key Compliance Requirements
Under the law, organizations must give individuals clear notice before collecting biometric data and obtain their affirmative, opt-in consent. Once collected, the data must be destroyed no later than 24 months after the consumer’s last interaction with the organization, or sooner if the original purpose has been fulfilled or the data is no longer needed. Data controllers must also implement reasonable security measures to prevent unauthorized access or misuse.
Unlike Illinois’ Biometric Information Privacy Act (BIPA), which has led to a wave of private litigation, Colorado’s biometric provisions do not grant individuals the right to sue. Instead, enforcement authority rests solely with the Colorado Department of Law, including the Attorney General and district attorneys. The law also removes typical CPA volume thresholds for biometric data—meaning even smaller employers or service providers must comply if they process any biometric identifiers.
Part of a National Privacy Shift
These changes reflect growing national momentum around biometric data regulation. Colorado’s approach stands alongside Illinois’ ongoing enforcement activity, including lawsuits against companies using facial recognition or fingerprint-based systems without proper consent.
To avoid penalties, covered entities must review and revise their data handling practices by the time the law takes effect. That includes updating consent procedures, retention schedules, and data protection policies for all systems that collect or store biometric information.
Sources: KRDO, Fisher Phillips, Inside Global Tech
–
By Cass Kennedy
