Technology

Existing law requires a county or municipality to publish legal notices in a physical print newspaper. The act requires a newspaper to also publish these notices online, either on its own website or by providing a link on its website to a location where the full text of the notice is available, such as the statewide public notice website. Legal notices published online must be free to access and cannot be kept behind a paywall or subscription. The act also requires the statewide public notice website to include a list of newspapers that meet the requirements to publish legal notices.(Note: This summary applies to this bill as enacted.)

The bill authorizes the public utilities commission (commission) to regulate broadband service and voice-over-internet protocol (VoIP) service in the state. The commission may adopt rules related to the quality, safety, and resiliency of broadband services in Colorado.The commission is authorized to conduct evaluations of broadband service facilities and infrastructure and to issue orders that require an internet service provider to take remedial actions to correct unsafe or inadequate service. The commission is required to submit to the general assembly an annual report regarding the quality, safety, and resiliency of broadband and VoIP services.(Note: This summary applies to this bill as introduced.)

The act prohibits individuals lawfully permitted to provide psychotherapy services in the state (regulated professionals) from allowing an artificial intelligence system (AI system) to interact with clients in any form of therapeutic communication without synchronous, real-time interaction between the regulated professional, the AI system, and the client, or generate therapeutic recommendations or treatment plans without review and approval by the regulated professional.     Except for educational, administrative, simulation, or training purposes or as part of a research program, a regulated professional shall not use an AI system to provide, direct, or guide psychotherapy, clinical intervention, counseling, diagnosis, treatment planning, or other activity that constitutes the practice of psychotherapy with an individual or group unless the use satisfies the conditions specified in the act. At initial client contact, a regulated professional shall inform clients of the prohibitions regarding use of AI systems in the practice of psychotherapy. Regulated professionals may be disciplined by the appropriate licensing board in the department of regulatory agencies for violations of this act.     The act allows regulated professionals to use an AI system to assist in providing administrative support or supplementary support, as these terms are defined in the act, for psychotherapy services if the regulated professional maintains responsibility for reviewing any outputs of the AI system used to provide administrative support or supplementary support. If a client's therapeutic session will be recorded or transcribed through the use of an AI system, the regulated professional must disclose in advance the use of an AI system and the purposes for its use, and obtain written, informed consent from the client.     The act does not prohibit a regulated professional from using an AI system within accredited or approved educational, instructional, or professional training programs, so long as the AI system is used solely for educational, administrative, simulation, or training purposes and is not deployed, marketed, or represented as a tool for use with clients, patients, or the public. Further, a regulated professional may be involved in the development, testing, or evaluation of an AI system solely for research purposes under the oversight of a federally registered institutional review board, so long as the AI system is not offered to consumers or used outside of the research setting.     The act does not apply to regulated professionals who use or recommend the use of technology in the state that does not diagnose or treat mental health disorders, clearly discloses that the technology is not a substitute for clinical care, and:Provides self-help, therapeutic homework, coaching, patient navigation, guided meditation, journaling, or other tools specified in the act; orIs regulated by the federal food and drug administration.     Except as provided in the act, the act also makes it an unfair or deceptive trade practice under the 'Colorado Consumer Protection Act' for an individual, corporation, or entity (person) to use any term, letter, or phrase in the use of an AI system in a manner that:Indicates or implies that the AI system's outputs are provided by, endorsed by, or equivalent to services provided by a regulated professional;Represents that the AI system provides psychotherapy services; orRepresents that a user's data is confidential in a manner that would lead a reasonable user to believe that the privacy of their data is protected in a manner similar to therapist-client confidentiality.      The act does not impose liability on a regulated professional for defects in or failures of an AI system that are attributable to the developer or deployer of the AI system.     Further, under conditions specified in the act, nothing in the act prohibits a person from developing, testing, or evaluating an AI system solely for research purposes or using an AI system in educational, instructional, or training programs. In addition, it is not an unfair or deceptive trade practice for a person to use a technology that does not diagnose or treat mental health disorders, clearly discloses that the technology is not a substitute for clinical care, and:Provides self-help, therapeutic homework, coaching, patient navigation, guided meditation, journaling, or other tools specified in the act; orIs regulated by the federal food and drug administration.(Note: This summary applies to this bill as enacted.)

Under the bill, a "covered business" is defined as a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate of such a legal entity, that:Conducts business in the state and generates a majority of its annual revenue from online services;Makes available online gaming services, products, or features that are reasonably likely to be accessed by a user who is a minor or who the covered business labels as a minor (covered minor);Collects users' personal data or has users' personal data collected on its behalf by a processor; andSolely or jointly with others determines the purposes and means of the processing of users' personal data.     The bill states that a covered business that processes the personal data of a covered minor owes a minimum duty of care to the covered minor. The bill also requires a covered business to:Configure default privacy settings provided to a covered minor to the highest level of privacy and to include certain default settings;Provide a prominent, accessible, and responsive tool to allow a covered minor to request that the covered minor's account be unpublished or deleted and, if the business receives such a request, to honor it within 15 days; andImmediately delete all data that relates to the determination of a user's age after it is determined that the user is a covered minor.     The bill prohibits a covered business from:Providing a covered minor with a single setting that makes all of the default privacy settings less protective at once;Requesting or prompting a covered minor to make their privacy settings less protective;Collecting, selling, sharing, or retaining personal data of a covered minor that is not necessary to provide an online gaming service, product, or feature with which the covered minor is actively and knowingly engaged;Using previously collected personal data of a covered minor for any purpose other than a purpose for which the personal data was collected;Permitting an individual to monitor the online activity of a covered minor or to track the location of the covered minor without providing a conspicuous signal to the covered minor when the covered minor is being monitored or tracked;Using the personal data of a covered minor to select, recommend, or prioritize media for the covered minor unless the covered minor makes certain requests or takes certain actions warranting such conduct by the covered business; orSending push notifications to a covered minor between 12 midnight and 6 a.m.     The bill imposes additional specific requirements and prohibitions for a covered business that collects users' personal data for the purpose of conducting age assurance.     The bill requires a covered business to ensure that the purchase price for an online gaming service, product, or feature that is made available through the covered business's online gaming service, product, or feature and that is reasonably likely to be accessed by a covered minor is listed in United States dollars at the point of sale.     A covered business shall impose and collect a fee on each add-on transaction that is conducted by a covered minor through the covered business's online gaming service, product, or feature. The amount of the fee is 5% of the amount of the transaction. Money collected as such fees is credited to the state public school fund.     The bill requires a social media platform to provide certain information on its website or mobile application concerning privacy policies and the use of algorithms. A social media platform is prohibited from using an algorithmic recommendation system to sell or otherwise distribute an illicit substance to a covered minor.(Note: This summary applies to this bill as introduced.)

Under current law, a political party must ensure that any person, upon request, is able to participate in a precinct caucus or a party assembly with the use of a video conferencing platform or alternative means of participation. The failure of any political party to make a reasonable effort to comply with these accessibility requirements constitutes discrimination on the basis of disability in a place of public accommodation.     The act clarifies that only a person who is otherwise eligible pursuant to statute to participate in a precinct caucus or a party assembly may request video conferencing or another alternative means of participation. The act also clarifies that a person who is subjected to a violation of a political party's duties regarding these accessibility requirements may file suit only against the central committee of the political party holding the caucus or assembly. An individual, including a member of the central committee of the political party or a volunteer for a political party, may not be held liable for a violation of these accessibility requirements. Upon a finding of a violation of these accessibility requirements, a court may require compliance with the applicable accessibility requirement and either actual monetary damages or a statutory fine of $3,500 for each violation.(Note: This summary applies to this bill as enacted.)

The bill creates the "Unmanned Aircraft Systems Rights and Authorities Act". The bill does the following:Authorizes an individual to operate an unmanned aircraft system (drone system) for recreational purposes in this state;Authorizes a person to operate a drone system for commercial purposes within this state if the business is lawful and the operation is in compliance with state and federal law;Prohibits the state or a political subdivision of the state (local government) from requiring the registration of an unmanned aircraft or a drone system beyond what may be required by state and federal law;Clarifies that the operation of a drone system in compliance with federal law does not, standing alone, give rise to legal liability;Establishes and limits the regulatory authority of the state; andEstablishes and limits the regulatory authority of a local government.In connection with establishing and limiting the regulatory authority of the state, the bill authorizes the state to regulate the use of drone systems owned by or used by the state or launching from or landing on state property. Exceptions to the state's regulatory authority are made for emergencies, maintenance, technical malfunctions, and law enforcement.In connection with establishing and limiting the regulatory authority of local governments, the bill prohibits a local government from regulating ownership, operation, design, manufacture, testing, maintenance, licensing, registration, certification, or equipment requirements or qualifications, training, or certification of a pilot, operator, or observer. A local government may regulate the use of drone systems owned by or used by the local government or launching from or landing on local government property. A local government's resolution or ordinance that is general in nature, such as a nuisance regulation, applies to a drone system.(Note: This summary applies to this bill as introduced.)

The bill establishes the "Surveillance Accountability and Freedom Ensured (SAFE) Act" (SAFE Act). On and after July 1, 2027, the SAFE Act requires a law enforcement agency to use surveillance technology only for lawful purposes directly related to public safety or for an active investigation.If a law enforcement agency uses surveillance technology to collect surveillance data, the law enforcement agency must comply with certain requirements related to the collection, storage, sharing, and destruction of the data.The law enforcement agency must ensure that:Facial recognition systems are only used after a warrant is obtained or in exigent circumstances when there is an imminent threat to public safety;Traffic cameras and automated license plate readers must only be used in public spaces and for specific enforcement purposes, such as traffic violations or identifying stolen vehicles; andDrone cameras are operated in compliance with federal aviation administration regulations.A law enforcement agency may store data collected by surveillance technology only for a specified amount of time depending on the type of technology used and how the data is collected or until an active investigation is concluded.A law enforcement agency shall not sell any data that is collected from its surveillance technologies, but the law enforcement agency may share the surveillance data with another law enforcement agency if the data is related to an active investigation and the other law enforcement agency agrees to comply with the requirements of the SAFE Act. A law enforcement agency must also ensure that surveillance data is permanently destroyed at the end of an applicable retention period or once the data is no longer needed for the matter. The bill creates civil penalties for violations of these provisions.The bill also requires a law enforcement agency to make certain information related to the law enforcement agency's compliance with the SAFE Act available to residents who request it at no cost to the resident.The bill requires the attorney general to conduct an audit of a law enforcement agency every 2 years and authorizes the attorney general to bring a civil action to enforce the SAFE Act.(Note: This summary applies to this bill as introduced.)

Beginning July 1, 2026, if a petitioner is under 18 years old at the time of filing a petition seeking to change the petitioner's name, the act requires the court to suppress the record unless the petitioner was previously convicted of a felony. The act authorizes the court to use the suppressed court record for administrative purposes, but the court is prohibited from publishing the petitioner's name or the petitioner's new name online. A petitioner who is under 18 years old is not required to give public notice of the name change. The act authorizes an individual to access a suppressed court record without a court order if the individual obtains verbal consent from a party to the case and submits an affidavit to the court, upon penalty of perjury, that the individual has obtained the verbal consent.(Note: This summary applies to this bill as enacted.)

The act creates new requirements and civil remedies beginning June 1, 2027, related to individuals under 18 years old (minors) who are featured in compensated content on online hosting platforms (online content).     A minor is considered to be engaged in content creation work if, over a 12-month period, the following 3 criteria are met:At least 30% of a content creator's online content produced within a 30-day period includes the minor's likeness, name, or photograph;The number of views of the online content meets the online hosting platform's compensation threshold or the content creator receives $0.10 or more per view, including compensation from sponsorships; andThe content creator receives at least $40,000 in actual compensation from the online content.     Content creators whose online content features a minor engaged in content creation work must maintain specific records, including:Proof of the minor's age;The total compensation generated; andThe total number of minutes the minor was featured in posts featuring online content.     A content creator shall compensate a minor engaged in content creation work by setting aside a portion of the gross earnings into a trust account for the minor until the minor reaches the age of majority or is declared emancipated. A court may distribute money from the trust account to the minor before the minor reaches the age of majority or is declared emancipated upon petition from the trustee and a finding that the money will only be used for specific expenses that solely benefit the minor.     An adult or an emancipated minor who was featured as a uniquely identifiable minor in a content creator's post featuring online content on or after June 1, 2027, may request that the content creator delete the post or remove the uniquely identifiable information. The content creator must comply with the request within 72 hours. If the content creator fails to comply after 30 days, the individual may sue for various types of relief, and the online hosting platform must review and take reasonable steps to remove the content unless certain exceptions apply.     The act prohibits a person from financially benefiting from knowingly producing or distributing online content of a minor with the intent to sexually gratify or elicit a sexual response in the viewer. Exceptions apply for law enforcement, reporting unlawful activity, legal proceedings, and certain actions engaged in by online hosting platforms. Online hosting platforms are required to develop and implement a risk-based strategy to help mitigate risks related to the monetization of the intentional sexualization of known minors.     A civil action may be filed on behalf of a minor for damages, including actual damages, punitive damages, and attorney fees, if a content creator fails to comply with specified provisions of the act.(Note: This summary applies to this bill as enacted.)

The bill prohibits law enforcement and other government entities from purchasing, or otherwise obtaining for anything of value, certain personal data from third parties. Law enforcement agencies and other government entities are also prohibited from sharing individuals' personal data between themselves.Exceptions are created for obtaining personal data, including after obtaining a judicial warrant, subpoena, or court order, when an individual consents to sharing their data and, in the case of an emergency, involving a threat to a person's life or physical safety.The bill creates a private cause of action for an individual who has their personal data obtained or shared in violation of the prohibitions in the bill. Personal data obtained or shared is excluded from trial and other court proceedings, subject to certain exceptions.(Note: This summary applies to this bill as introduced.)