SB 26-051 (2026), Age Attestation on Computing Devices Act
Enacted, not yet in force
Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343)
Effective 2028-07-01 · Applies to private
Requires operating system providers and covered application stores to let an account holder indicate a birth date, age, or age bracket at device setup and to share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers, who must treat the signal as the primary indicator of a user's age range unless they have clear and convincing information otherwise. Signed June 3, 2026; codified as article 30 of title 6 (Age Attestation for Online Users).
| Age threshold | 18 |
| Verification methods | self declaration, device signal |
| Penalties | Civil penalty up to $2,500 per minor for a negligent violation and up to $7,500 per minor for an intentional violation, with a good faith compliance defense for erroneous age signals. |
| Enforcement body | Colorado Attorney General |
| Private suits | no |
Source: Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343)
SB 24-041 (2024), Privacy Protections for Children's Online Data
In force
Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
Effective 2025-10-01 · Applies to private
Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments. Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed May 31, 2024.
| Age threshold | 18 |
| Verification methods | parental consent |
| Penalties | Violations are deceptive trade practices under the Colorado Consumer Protection Act. |
| Enforcement body | Colorado Attorney General and district attorneys |
| Private suits | no |
Source: Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
HB 24-1136 (2024), Healthier Social Media Use by Youth
Enjoined
Colo. Rev. Stat. § 6-1-1601 (and § 22-2-127.8)
Effective 2026-01-01 · Applies to private
Requires a social media platform with more than 100,000 active Colorado users to give users under 18 information on how social media affects the developing brain and youth mental and physical health, and to display a notification every 30 minutes once a minor has spent one hour on the platform in a 24 hour period or is using it between 10 p.m. and 6 a.m. Signed June 6, 2024, with the platform requirement set for January 1, 2026, but preliminarily enjoined before that date.
| Age threshold | 18 |
| Enforcement body | Colorado Attorney General (Colorado Consumer Protection Act) |
Litigation: D. Colo. No. 1:25-cv-02538, NetChoice v. Weiser (U.S. District Court for the District of Colorado). Senior Judge William J. Martinez granted NetChoice a preliminary injunction on November 6, 2025, finding the notification requirement likely compels speech in violation of the First Amendment and fails strict scrutiny. The injunction blocked the platform requirement before its January 1, 2026 start date.
Source: Colo. Rev. Stat. § 6-1-1601 (and § 22-2-127.8)