HB 24-1130: Protection of Biometric Data Privacy

• Requires businesses collecting biometric identifiers to obtain clear, written consent and provide specific information about collection purpose, retention length, and any third-party sharing before collection occurs.

• Controllers must adopt written policies establishing retention schedules for biometric data, data breach protocols, and mandatory deletion timelines (by initial purpose satisfaction, 24 months of inactivity, or within 45 days when storage is no longer necessary).

• Prohibits selling, leasing, or trading biometric identifiers without consumer consent; prohibits refusing service or charging different prices based on refusal to consent to biometric collection unless necessary for the service.

• Entitles consumers to request free access to their biometric data category, collection source, processing purpose, and information about third-party disclosures for entities meeting specific size thresholds.

• Takes effect July 1, 2025, and applies to any controller processing biometric data regardless of data volume, with exemptions for public safety uses under existing Colorado Privacy Act exceptions.