Colorado § 40-10.1-610 - Consumer protection - waiver of rights void - biometric data and biometric identifiers - safety policies - training - data retention - rules.

§ 40-10.1-610. Consumer protection - waiver of rights void - biometric data and biometric identifiers - safety policies - training - data retention - rules.

(1) [Editor's note: Subsection (1) is effective January 1, 2027.]

(a) A provision in a contract between a transportation network company and a driver or rider is void as against public policy if the provision:

(I) Attempts to waive or waives a right specified in this part 6; or

(II) Attempts to waive or waives a right to bring a cause of action provided by the "Colorado Consumer Protection Act", article 1 of title 6, except to the extent the waiver is preempted by federal law.

(b) A provision in a contract between a transportation network company and a driver or rider must comply with the federal "Ending Forced Arbitration of Sexual Assault and Sexual Harassment Act of 2021", 9 U.S.C. sec. 401 et seq., as amended.

(c) To the extent required by federal law, a predispute arbitration agreement or predispute joint-action waiver, as those terms are defined in 9 U.S.C. sec. 401, is not enforceable with respect to a claim that constitutes a sexual assault dispute or a sexual harassment dispute, as those terms are defined in 9 U.S.C. sec. 401.

(2) [Editor's note: Subsection (2) is effective January 1, 2027.]

(a) Within three months after the effective date of this section for a large-scale transportation network company and within six months after the effective date of this section for a small-scale transportation network company, a transportation network company shall:

(I) Develop and enforce a policy to prevent imposter drivers, account sharing, and account renting;

(II) Develop and enforce a policy to prevent sexual assault, physical assault, and homicide against or committed by the transportation network company's drivers;

(III) Develop and enforce a policy prohibiting the transport of an unaccompanied youth unless the youth is part of a duly authorized family account, in which a parent or guardian must be present when the youth enters the vehicle or confirms authorization for the prearranged ride;

(IV) Except as authorized in a policy developed pursuant to subsection (2)(a)(III) of this section, develop and implement a policy that allows a driver to refuse a prearranged ride to an individual whom the driver believes is not authorized to use the account requesting the prearranged ride. The policy must ensure that the driver is not penalized by the transportation network company for refusing a prearranged ride to an individual whom the driver believes is not an authorized rider on the account requesting the prearranged ride.

(V) Develop and implement a policy establishing procedures for the deactivation of a driver if the transportation network company is notified of an allegation against a driver as described in section 40-10.1-605 (3)(c)(VI);

(VI) Develop and implement a policy to notify drivers and riders of and train drivers and riders about any updates to transportation network company safety policies;

(VII) Develop and implement a policy to prevent crimes committed against drivers by riders;

(VIII) Develop and implement a policy to prohibit drivers from offering or selling food or beverages that are not factory-sealed to riders as described in section 40-10.1-605 (7.7)(a);

(IX) Provide copies of the policies created pursuant to this subsection (2) to the attorney general and to the commission; and

(X) Provide copies of the policies created pursuant to this subsection (2) to every driver who provides services for the transportation network company.

(b) Within ten business days after an update to a policy created pursuant to this subsection (2), a transportation network company shall provide a copy of the updated policy to the attorney general, the commission, and every driver who provides services for the transportation network company.

(c) A transportation network company shall make each policy created pursuant to this subsection (2) available to a driver on the transportation network company's digital network in the language the driver uses on the transportation network company's digital network.

(3) ​[Editor's note: Subsection (3) is effective January 1, 2027.]​

(a) A transportation network company shall not collect biometric data or biometric identifiers from a driver or rider without first obtaining the consent of the driver or rider.

(b) If a transportation network company collects biometric data or biometric identifiers from a driver or rider, the transportation network company shall comply with section 6-1-1314.

(4) (a) [Editor's note: Subsection (4)(a) is effective January 1, 2027.] A transportation network company shall process data in compliance with the "Colorado Privacy Act", part 13 of article 1 of title 6.

(b) On or before June 1, 2028, the commission shall adopt rules governing the retention, storage, and use of and access to the data collected by a transportation network company.

(c) Until the commission adopts rules governing the collection of data pursuant to subsection (4)(b) of this section, a transportation network company shall retain all audio and video recordings received from a prearranged ride for thirty days after the prearranged ride; except that, if a person files a complaint against a transportation network company with the commission or a prearranged ride is the subject of an active law enforcement investigation, the transportation network company shall retain the audio and video recording for one year or until the investigation is completed, whichever is longer.

(d) On or before June 1, 2028, the commission shall adopt rules governing a complainant's access to the data collected by a transportation network company related to a complaint described in section 40-10.1-605 (3)(c)(VI).

(5) [Editor's note: Subsection (5) is effective January 1, 2027.] This section does not apply to a transportation network company that:

(a) Either serves riders, at least seventy-five percent of whom are minors, or earns at least ninety percent of the transportation network company's revenue from contracts with a public or private school, the federal government, the state, or an agency or a political subdivision of the federal government or of the state; and

(b) Has at least ninety percent of the transportation network company's drivers in compliance with the commission's rules adopted pursuant to section 40-10.1-608 (3)(a).

Source: L. 2026: Entire section added, (HB 26-1424), ch. 333, p. 1976, § 5, effective (see editor's note).

Editor's note: (1) Section 8(1) of chapter 333 (HB 26-1424), Session Laws of Colorado 2026, provides that the act adding this section takes effect August 12, 2026; except that subsections (1), (2), (3), (4)(a), and (5) take effect January 1, 2027.

(2) (a) Section 8(2) of chapter 333 (HB 26-1424), Session Laws of Colorado 2026, provides that the act adding subsections (4)(b), (4)(c), and (4)(d) applies to offenses committed on or after August 12, 2026.

(b) Section 8(2) of chapter 333 (HB 26-1424), Session Laws of Colorado 2026, provides that the act adding subsections (1), (2), (3), (4)(a), and (5) applies to offenses committed on or after January 1, 2027.

Cross references: For the legislative declaration in HB 26-1424, see section 1 of chapter 333, Session Laws of Colorado 2026.

PART 7

LARGE-MARKET TAXICAB SERVICES