Colorado Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Colorado Site Laws Move Faster Than Most

Colorado was the third state in the country to enact a comprehensive consumer privacy law, and the General Assembly has amended that law in nearly every session since. The state also became the first to pass a broad AI accountability statute in 2024, and the debate over that statute shaped the 2025 special session and the entire 2026 regular session, which ran from January through May 13, 2026. Governor Jared Polis signed seven technology bills and vetoed five in the weeks after adjournment.

For you, the practical result is that Colorado site laws come in three layers. The Colorado Privacy Act and the regulations under that law form the base layer, and the thresholds decide whether that layer applies. A second layer of consumer protection, breach notification, and tax statutes applies to nearly every business regardless of size. A third layer of AI and minors’ safety laws is new, mostly takes effect on January 1, 2027, and reaches any site that uses chatbots or automated decisions. The sections below walk through each layer so you can see exactly where your site stands.

The Colorado Privacy Act and the 2025 Amendments

The foundation of Colorado site laws, the Colorado Privacy Act codified at C.R.S. 6-1-1301 and following sections, took effect on July 1, 2023. The law applies to any controller that conducts business in Colorado or targets Colorado residents and that either controls or processes the personal data of 100,000 or more consumers in a calendar year, or controls or processes the data of 25,000 or more consumers and derives revenue or a discount from selling personal data. If you cross a threshold, you must post a compliant privacy notice, honor requests to access, correct, delete, and port data, allow consumers to opt out of targeted advertising, sales, and profiling, obtain opt in consent before processing sensitive data, and conduct data protection assessments for high risk processing. The Attorney General and district attorneys enforce the law, with no private right of action.

Two amendments changed the Colorado Privacy Act in ways that reach beyond the thresholds. House Bill 24-1130, effective July 1, 2025, added biometric data rules that apply to any controller in Colorado regardless of how many consumers you serve. If you collect fingerprints, face scans, or voiceprints, including through a time clock or a login feature, you must post a written retention and deletion policy, obtain consent before collection, and refrain from selling biometric identifiers. Senate Bill 24-041, effective October 1, 2025, added protections for minors under 18. Any controller that offers an online service, product, or feature to a known minor owes a duty of care to avoid heightened risks of harm, must obtain consent before targeted advertising, sale of data, or profiling involving a minor, and may not use system design features that significantly increase a minor’s use of the service without consent.

The Colorado Privacy Act rules also require you to honor universal opt out mechanisms such as Global Privacy Control, a requirement that has been in force since July 1, 2024. Because the same browser signal will become mandatory in every browser sold in California beginning January 1, 2027, testing your site against Global Privacy Control now serves both states at once. Small businesses below the thresholds do not have to honor the signal under Colorado site laws, but larger partners often require compliance by contract.

Breach Notification: A 30 Day Clock

The most concrete of the Colorado site laws for any website that stores customer data is the breach notification statute at C.R.S. 6-1-716. The law, strengthened by House Bill 18-1128 effective September 1, 2018, applies to any person or business that maintains, owns, or licenses computerized data containing personal information about Colorado residents. Personal information means a first name or initial plus last name combined with a Social Security number, student, military, or passport ID number, driver’s license or state ID number, medical information, health insurance information, or biometric data, as well as a username or email address combined with a password or security question that would permit access to an online account.

When you become aware that a security breach may have occurred, you must conduct a prompt, good faith investigation, and if unencrypted personal information was misused or is reasonably likely to be misused, you must notify affected residents within 30 days after determining that a breach occurred. That 30 day deadline is among the shortest in the country. If the breach affects 500 or more Colorado residents, you must also notify the Colorado Attorney General within the same 30 days, and if 1,000 or more residents are affected, you must notify the nationwide consumer reporting agencies. Notice may go by mail, email, or telephone, or by substitute notice when direct notice would cost more than $250,000 or reach more than 250,000 people.

The same 2018 law added two duties under Colorado site laws that catch small businesses off guard. C.R.S. 6-1-713.5 requires you to implement and maintain reasonable security procedures appropriate to the nature of the personal information, and C.R.S. 6-1-713 requires a written policy for destroying paper and electronic records containing personal information when they are no longer needed. The Attorney General enforces all three sections under the Colorado Consumer Protection Act, which allows civil penalties of up to $20,000 per violation.

The Colorado Consumer Protection Act and Your Online Store

Colorado polices advertising and sales through the Colorado Consumer Protection Act at C.R.S. 6-1-105, which lists dozens of deceptive trade practices, including false statements about goods and services, bait advertising, misrepresenting price reductions, and failing to disclose material information. House Bill 23-1290, effective 2023, made every unfair or unconscionable act in trade an additional violation and removed a “significant public impact” hurdle for private plaintiffs, which has expanded lawsuits against online sellers.

For your site, this is the part of Colorado site laws behind the everyday rules. Reference prices that were never charged, timers that reset on every visit, subscription trials that convert without clear disclosure, fees revealed only at checkout, and staff written testimonials all create exposure. Colorado also has an automatic renewal statute at C.R.S. 6-1-732 that requires clear disclosure of renewal terms, affirmative consent, an online cancellation method for online sign ups, and a renewal notice for contracts with terms of 12 months or more. Consumers may recover actual damages, statutory damages of $500, or treble damages for bad faith conduct, plus attorney fees, and the Attorney General may seek civil penalties.

Colorado Site Laws for eCommerce: Sales Tax and the Retail Delivery Fee

Colorado imposes a state sales tax of 2.9 percent, and counties, cities, and special districts add local rates that push combined rates above 9 percent in some areas. Following the U.S. Supreme Court’s 2018 decision in South Dakota v. Wayfair, Colorado required remote sellers to register with the Department of Revenue and collect tax once their retail sales into Colorado exceed $100,000 in the current or previous calendar year, a rule in place since December 1, 2018. Colorado has no transaction count test, and marketplace facilitators have been required to collect on facilitated sales since October 1, 2019.

Colorado’s home rule cities complicate this corner of Colorado site laws, because roughly 70 cities administer their own sales tax. The state addressed that problem with the Sales and Use Tax System, known as SUTS, which lets you file once for the state and for participating home rule cities, and with a destination sourcing rule that requires you to charge the rate for the customer’s delivery address. The second complication is the retail delivery fee, in effect since July 1, 2022, which applies to every retail sale of taxable tangible property delivered by motor vehicle to a Colorado address. The fee is adjusted annually and is roughly 29 cents per delivery in the fiscal year that began July 1, 2025, but businesses with $500,000 or less in retail sales in the prior year are exempt from collecting the fee. Standard software delivered electronically is taxable in Colorado, so check your product categories against the Department’s guidance instead of trusting default platform settings.

The AI Rewrite: SB 26-189 Takes Effect January 1, 2027

The most watched change to Colorado site laws in 2026 is the repeal and replacement of the Colorado AI Act. The original law, Senate Bill 24-205, was signed on May 17, 2024, and would have required developers and deployers of high risk AI systems to conduct impact assessments and prevent algorithmic discrimination. The effective date moved from February 1, 2026, to June 30, 2026, under SB 25B-004, signed August 28, 2025, after a special session failed to agree on amendments. On April 9, 2026, xAI sued to block the law, the U.S. Department of Justice intervened in support, and on April 27, 2026, a federal magistrate judge ordered the state not to enforce the statute.

The General Assembly responded within days. Senate Bill 26-189, introduced May 1, 2026, passed the Senate 34 to 1 and the House 57 to 6 on May 9, 2026, and Governor Polis signed the bill on May 14, 2026. The replacement law, formally the Automated Decision-Making Technology Act, drops the algorithmic discrimination duties and impact assessments in favor of a disclosure and rights framework. Beginning January 1, 2027, any organization that uses automated decisionmaking technology that materially influences a consequential decision about a Colorado consumer, such as a decision about employment, housing, credit, education, health care, or insurance, must notify the consumer before the decision, explain an adverse outcome afterward, disclose what personal data was used, allow the consumer to correct that data, and provide meaningful human review on request. The Attorney General must complete implementing rules before enforcement begins, and formal proposed rules were filed on August 11, 2026, with a public hearing set for October 26, 2026.

For a small business website, this piece of Colorado site laws matters if you use AI screening tools for job applicants, tenant applications, loan or financing decisions, or similar consequential choices. A product recommendation engine or a marketing personalization tool does not make a consequential decision and falls outside the law. If you do use covered tools, ask your vendor now how the notice, explanation, and human review requirements will be delivered before January 1, 2027.

The Chatbot Law: HB 26-1263 Takes Effect January 1, 2027

The second new AI statute among Colorado site laws reaches far more websites. House Bill 26-1263, signed by Governor Polis on May 29, 2026, after passing the House 42 to 22 and the Senate 24 to 11, sets baseline safety standards for conversational AI services offered in Colorado and takes effect January 1, 2027. Operators must disclose that users are interacting with artificial intelligence rather than a human, must estimate whether a user is a minor and repeat that disclosure regularly for minors, and must maintain protocols that provide suicide prevention resources when a user expresses suicidal thoughts or interest in self harm, with periodic reports on how often those protocols trigger.

For minors, the law goes further. Operators may not provide points, rewards, or similar gamification that encourages engagement, must take reasonable measures to prevent sexually explicit content and statements that simulate emotional dependence, and must offer parental controls when the service is accessible to children under 13. The law works alongside House Bill 24-1136, effective January 1, 2026, which requires social media platforms to show users under 18 a pop up warning about the mental health effects of excessive use after one hour of use in a day or during the hours of 10 p.m. to 6 a.m. If your site runs any AI assistant that holds an open ended conversation, plan to add disclosure, age estimation, and crisis response before the January 1, 2027 effective date.

What the Governor Vetoed and What Colorado Does Not Have

Colorado site laws in 2026 are also defined by what did not pass. On May 28, 2026, Governor Polis vetoed House Bill 26-1418, which would have required online games likely to be used by minors to add a 5 percent fee to in game purchases to fund youth mental health programs, citing conflicts with the Taxpayer’s Bill of Rights and calling in game content a form of digital storytelling. He also vetoed House Bill 26-1255, which would have required social media platforms to report posts containing threats of physical harm to law enforcement. In 2025, Governor Polis vetoed Senate Bill 25-086, a sweeping social media bill that would have required platforms to remove minors who violated policies and respond to law enforcement warrants within 72 hours, and the House fell short of overriding that veto.

Colorado also has no general age verification statute for adult content and no ban on minors creating social media accounts. The state’s approach runs through the Colorado Privacy Act minors’ amendments, the chatbot law, and the 2026 social media warning requirement rather than through ID checks. Governor Polis signed House Bill 26-1058 in May 2026, which requires parents who feature their children in 30 percent or more of monetized online content to set aside earnings in a trust and allows those children to request removal of the content as adults, joining California, Illinois, and Utah.

What You Should Do Now

You do not need a compliance department to satisfy Colorado site laws, but you do need a short list of concrete tasks that reflect the rules in force today and the two AI laws arriving on January 1, 2027. Each step below addresses a current or scheduled obligation, and each also positions you well if the next General Assembly revives the bills that were vetoed in 2026.

1. Confirm whether you cross a Colorado Privacy Act threshold, and if you do, verify that your site honors Global Privacy Control, offers opt outs for targeted advertising, and obtains consent before profiling or advertising to known minors.
2. Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents within 30 days and the Attorney General for incidents affecting 500 or more residents.
3. Review pricing displays, subscription flows, and reviews against the Colorado Consumer Protection Act and the automatic renewal statute.
4. Total your Colorado retail sales against the $100,000 threshold, register through SUTS if you crossed the line, and confirm whether the retail delivery fee applies.
5. Inventory any chatbot or automated decision tool on your site and ask your vendors how disclosure, age estimation, crisis protocols, and human review will be delivered before January 1, 2027.

Once those tasks are done, you will be current on every one of the Colorado site laws covered in this report, so put two dates on your calendar: October 26, 2026, when the Attorney General holds the public hearing on the SB 26-189 rules, and January 1, 2027, when both AI laws take effect. Colorado’s next regular session opens in January 2027 with a new governor, and the vetoed social media and gaming bills are widely expected to return.

Key Takeaways

• The Colorado Privacy Act applies above 100,000 consumers, or 25,000 with data sales, and its minors’ protections have applied since October 1, 2025.
• Biometric data rules under HB 24-1130 have applied to every business since July 1, 2025, regardless of size.
• Breach notices are due within 30 days, with Attorney General notice at 500 or more residents.
• Remote sellers collect Colorado sales tax after $100,000 in sales, and the retail delivery fee applies above $500,000 in prior year sales.
• SB 26-189 and HB 26-1263, both signed in May 2026, bring automated decision and chatbot rules into force on January 1, 2027.

Frequently Asked Questions About Colorado Site Laws

Does the Colorado Privacy Act apply to my small business?

Only if you conduct business in Colorado or target Colorado residents and process the personal data of 100,000 or more consumers a year, or 25,000 or more consumers while earning revenue or a discount from selling data. The biometric rules, breach statute, consumer protection act, and sales tax rules apply regardless of size.

Do Colorado site laws apply to my business if I am located in another state?

Yes, in most cases. The Colorado Privacy Act reaches any controller that targets Colorado residents and crosses a threshold, the breach statute covers anyone holding Colorado residents’ data, the consumer protection act reaches sales to Colorado residents, and the sales tax rules apply once your Colorado sales exceed $100,000.

Do Colorado site laws require age verification on my website?

No. Colorado has no general age verification mandate. The minors’ amendments to the Colorado Privacy Act apply when you actually know a user is under 18, and the chatbot law requires age estimation for conversational AI beginning January 1, 2027. Federal COPPA rules still apply if your site is directed at children under 13.

Is the Colorado AI Act part of Colorado site laws now?

No. The original Colorado AI Act, SB 24-205, was repealed before its June 30, 2026 effective date. The replacement, SB 26-189, signed May 14, 2026, takes effect January 1, 2027, and applies only to automated decisionmaking technology that materially influences consequential decisions such as employment, housing, credit, and insurance.

Do Colorado site laws require me to disclose AI chatbots on my website?

Beginning January 1, 2027, yes. HB 26-1263 requires operators of conversational AI services to disclose that users are talking to AI, estimate whether users are minors, and maintain crisis response protocols. Until then, disclosure is a best practice rather than a legal requirement under Colorado site laws.

Conclusion

Colorado site laws in 2026 reward the owner who reads final text rather than early drafts. The Colorado Privacy Act and its biometric and minors’ amendments define the privacy baseline, the breach statute sets a strict 30 day clock, the consumer protection act and automatic renewal statute govern your checkout, and the sales tax rules pair a $100,000 threshold with a retail delivery fee that most small sellers can skip. The AI story that dominated two years of headlines ended with two narrower laws signed in May 2026, SB 26-189 for automated decisions and HB 26-1263 for chatbots, both effective January 1, 2027. Finish the five tasks above this fall and you will meet every current requirement while staying ready for whatever the next General Assembly sends your way.