Colorado § 6-1-1302 - Legislative declaration.

§ 6-1-1302. Legislative declaration.

(1) The general assembly hereby:

(a) Finds that:

(I) The people of Colorado regard their privacy as a fundamental right and an essential element of their individual freedom;

(II) Colorado's constitution explicitly provides the right to privacy under section 7 of article II, and fundamental privacy rights have long been, and continue to be, integral to protecting Coloradans and to safeguarding our democratic republic;

(III) Ongoing advances in technology have produced exponential growth in the volume and variety of personal data from individuals, including minors, being generated, collected, stored, and analyzed, and these advances present both promise and potential peril;

(IV) The ability to harness and use data in positive ways is driving innovation and brings beneficial technologies to society, but it has also created risks to privacy and freedom; and

(V) The unauthorized disclosure of personal information, including a minor's personal information, and loss of privacy can have devastating impacts ranging from financial fraud, identity theft, and unnecessary costs in personal time and finances to destruction of property, harassment, reputational damage, emotional distress, and physical harm;

(b) Determines that:

(I) Technological innovation and new uses of data can help solve societal problems and improve lives, and it is possible to build a world where technological innovation and privacy can coexist; and

(II) States across the United States are looking to this part 13 and similar models to enact state-based data privacy requirements, including data privacy requirements specifically targeted at minors' data, and to exercise the leadership that is lacking at the national level; and

(c) Declares that:

(I) By enacting this part 13, Colorado will be among the states that empower consumers, including minors, to protect their privacy and require companies to be responsible custodians of data as they continue to innovate;

(II) This part 13 addresses issues of statewide concern and:

(A) Provides consumers the right to access, correct, and delete personal data and the right to opt out not only of the sale of personal data but also of the collection and use of personal data;

(A.5) Provides minors the right to control their personal data;

(B) Imposes an affirmative obligation upon companies to safeguard personal data; to provide clear, understandable, and transparent information to consumers about how their personal data are used; and to strengthen compliance and accountability by requiring data protection assessments in the collection and use of personal data; and

(C) Empowers the attorney general and district attorneys to access and evaluate a company's data protection assessments, to impose penalties where violations occur, and to prevent future violations.

Source: L. 2021: Entire part added, (SB 21-190), ch. 483, p. 3445, § 1, effective July 1, 2023. L. 2024: (1)(a)(III), (1)(a)(V), (1)(b)(II), and (1)(c)(I) amended and (1)(c)(II)(A.5) added, (SB 24-041), ch. 296, p. 2018, § 1, effective October 1, 2025.