The act requires an operating system provider that operates a publicly available internet website, software application, online service, or platform that distributes and facilitates, on a commercial basis, the download of applications from third-party developers to users of devices (covered application store) or makes a covered application store available preinstalled on an operating system to:Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or age bracket of the user of that device in order to provide a signal regarding the user's age (age signal) to applications available in the covered application store;Provide application developers with a reasonably consistent, real-time application programming interface to request and receive an age signal; andSend only the minimum amount of information necessary to comply with the act. An operating system provider or covered application store shall not share an age signal with a third party for a purpose not required by the act. The act requires a consumer software application that is accessed through a covered application store and that may be run or directed by a user on a device (covered application) to request an age signal with respect to a particular user when the covered application is initially launched or when a user first creates an account. A covered application that receives an age signal is deemed to have knowledge of the age range of the user to whom that age signal pertains across all platforms of the application and points of access of the application. However, if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range. A developer shall ensure that a covered application that receives an age signal does not:Request more information concerning a user from an operating system provider or a covered application store than is necessary to comply with the act; orCommunicate an age signal to a third party for a purpose not required by the act. With respect to a device for which account setup was completed before July 1, 2028, the act requires an operating system provider to provide, before January 1, 2029, an accessible interface that allows an account holder to indicate the birth date or age of the user of that device for the purpose of providing an age signal regarding the user's age-bracket data to covered applications available in the operating system provider's covered application store. If a covered application last updated on or after July 1, 2027, was downloaded to a device before July 1, 2028, and the covered application has not requested an age signal with respect to the user of the device on which the covered application was downloaded, the covered application must request an age signal from the covered application store from which the covered application was downloaded with respect to that user before January 1, 2029. A person that violates the act must pay a civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation. The penalty is assessed and recovered in a civil action brought by the attorney general. An operating system provider or covered application store that makes a good faith effort to comply with the act is not liable for an erroneous age signal or for conduct by a covered application that receives an age signal.(Note: This summary applies to this bill as enacted.)
The bill criminalizes the use of an individual's fingerprint, voiceprint, retina, iris, or facial map (personally identifying feature) in an advertisement, deepfake, image, video, voice recording, or other digital depiction, without the individual's permission (unlawful use of a personally identifying feature). Unlawful use of a personally identifying feature is a class 5 felony, and unlawful use of a personally identifying feature with the intent to harm the individual or another individual is a class 4 felony.An individual harmed by an unlawful use of a personally identifying feature may bring a civil cause of action and collect damages and reasonable attorney fees.(Note: This summary applies to this bill as introduced.)
The act requires operators of certain websites, online services, online applications, or mobile applications (covered platforms) to ensure that each covered platform provides a streamlined process to allow Colorado law enforcement agencies to contact the covered platform at all times. The process must, at a minimum, make available a staffed hotline for Colorado law enforcement agencies for the purposes of:Receiving and responding to questions about search warrants;Acknowledging the receipt of a search warrant within 8 hours after receipt; andProviding status updates on search warrant compliance to a requesting Colorado law enforcement agency. An operator must comply with a search warrant within 72 hours after receiving the search warrant if certain conditions apply. A court may reasonably extend this time if the court makes a written finding that the operator or covered platform has shown good cause for the extension and that an extension would not cause an adverse result. The failure of an operator or a covered platform to comply with the requirements of a court-ordered search warrant supports a finding of contempt of court. The attorney general or a district attorney with jurisdiction may enforce the act.(Note: This summary applies to this bill as enacted.)
