AI & Human Authenticity
Colorado Privacy Act Biometric Data: What HB 1130 Requires
HAR Editorial Team
If your business collects fingerprints, face scans, or voiceprints from Colorado residents or employees, the rules changed. The Colorado Privacy Act biometric data amendment, HB24-1130, took effect Ju...
Colorado Privacy Act Biometric Data: What HB 1130 Requires
If your business collects fingerprints, face scans, or voiceprints from Colorado residents or employees, the rules changed. The Colorado Privacy Act biometric data amendment, HB24-1130, took effect July 1, 2025. It applies even to some organizations that were exempt from the rest of the law, and it carries real enforcement risk.
Here is the short answer. HB 1130 requires you to give written notice and get consent before collecting or processing biometric identifiers. It also restricts selling, leasing, or disclosing that data without separate consent. Employers face added limits, since a job cannot simply be conditioned on handing over a face or fingerprint scan when it is not needed. You must also set retention and deletion schedules and respond to deletion requests.
Below, we explain what counts as biometric data, who must comply, and what a compliant consent notice includes. We also cover employer duties and common mistakes. At the Human Authenticity Registry, we build around consent-first handling and deletion rights, so we read this law as a practical standard, not just a legal checklist.
Why the Colorado biometric amendment matters
What the amendment changes
Before HB 1130, the Colorado Privacy Act mostly reached larger businesses and left employee data alone. The biometric amendment closes those gaps. The usual size thresholds do not shield you, and employee and applicant data is no longer a safe harbor for this category. The table shows the shift.
Issue | Rest of the Colorado Privacy Act | Biometric identifier rules |
|---|---|---|
Who is covered | Businesses above consumer-volume thresholds | Any controller handling biometric identifiers, whatever the volume |
Employees and applicants | Generally excluded | Covered |
Consent | Opt-in for sensitive data | Written notice and consent before collection |
Retention | General data minimization | Written retention and deletion schedule |
If you can use it to identify a specific person, Colorado treats it as biometric, no matter how small your business is.
What counts as a biometric identifier
Under the amendment, a biometric identifier is data generated by measuring or analyzing a person's body or behavior to identify them. Fingerprints, voiceprints, retina and iris scans, and facial geometry are the clear examples. Other unique physical or behavioral patterns count too, when you use them alone or in combination to recognize one individual.
Purpose matters as much as format. Photographs and audio recordings are generally outside the definition, unless the data is generated to identify a specific person. A headshot on your team page is not covered. The same image run through facial recognition software to match a face is covered. Ask what the system does with the data, not just what the file looks like.
Why you should care now
The law took effect July 1, 2025, and you are now well past the point where a grace period could excuse a gap. Violations of the Colorado Privacy Act are enforced by the state attorney general and district attorneys as deceptive trade practices. We cover penalties in a later section.
The practical risk is also operational. Many companies adopted biometric tools without noticing. A time clock with a fingerprint reader, a building entry system with face matching, or a hiring platform that scores video interviews can all trigger the rules. Start by listing every tool that touches a face, finger, or voice. You cannot write a notice for a system you have not found.
How to comply with HB 1130 step by step
Inventory first, then write the policy
Meeting the Colorado Privacy Act biometric data rules is mostly documentation, and you can finish it in a few weeks if you work in order:
List every system that captures a face, fingerprint, voice, or iris, including vendor tools.
Write down the specific purpose of each one.
Adopt a written policy with a retention schedule, permanent deletion guidelines, and a data security incident response protocol.
Draft your notice and consent form.
Build a process for deletion requests, with a named owner.
Review vendor contracts for deletion and no-resale terms.
Vendors need the same scrutiny as your own systems. A processor that keeps face templates after you stop using its service is still your exposure. Put deletion duties and a ban on the vendor's right to resell or reuse the data in writing.
Get notice and consent right
Consent comes before collection, not after. Tell people in plain language what you collect, why, and how long you keep it. Get consent separately from your general terms, so no one agrees by scrolling past. Record who agreed, when, and to which version of the notice.
Collect only what you can explain, keep it only as long as the purpose lasts, and delete it on schedule.
Test the flow yourself before launch. Open the form on a phone and read it as a stranger would. If someone declines, check what happens next. Where you can, offer a non-biometric alternative, such as a badge or PIN, so refusing does not lock a person out.
Employer rules for employee and applicant biometrics
When you can require a scan
Employees and applicants are covered, so consent is the starting point, and it cannot be buried in an onboarding packet. You may make biometric consent a condition of employment only for narrow purposes. Under the Colorado Privacy Act biometric data rules, those purposes are:
Access to secure physical locations or electronic hardware and software
Recording when an employee's workday starts and ends
Improving or monitoring workplace safety or security
Protecting the public in an emergency or crisis
If the scan does not serve one of these purposes, an employee can say no without losing the job.
Applicants, remote teams, and retention
Applicants get the same protection. Say a hiring platform scores video interviews by analyzing facial geometry. You need written notice and consent first, and hiring alone is rarely a permitted purpose. Collect only what the role demands, and offer a standard interview instead.
Remote workers raise the same question. Verifying identity over video is common, but a face match is not always necessary. A badge, a PIN, or a manual ID check often does the job without a biometric. That is the logic behind selective disclosure, which we support at HAR: share only what the situation requires.
Finally, keep a written schedule and delete the data once its purpose ends, for example when someone leaves or loses access. Tell your vendors the same.
Consumer rights, enforcement, and penalties
Rights people can exercise
Anyone whose data you hold can use the standard Colorado Privacy Act rights, and they apply to biometric identifiers too. Plan for each request before it arrives, because the clock is short. You generally have 45 days to respond, with one 45-day extension if you explain why.
Right | What you must do |
|---|---|
Access | Confirm whether you hold their biometric data |
Correction | Fix inaccurate data |
Deletion | Erase the data, including copies at vendors |
Appeal | Review a denied request and answer in writing |
Deletion deserves a dry run. Pick a test record and trace it through every system, from the scanner to backups to your vendor's servers. If you cannot show where a face template lives, you cannot prove you removed it.
Who enforces the law and what it costs
The state attorney general and district attorneys enforce the Colorado Privacy Act biometric data rules. There is no private right of action, so individuals cannot sue you directly under this law. That does not make the risk small. A violation is a deceptive trade practice under the Colorado Consumer Protection Act, with civil penalties of up to $20,000 per violation.
Consent gaps multiply with every person you scan.
Regulators can count violations per affected consumer or transaction. A face-scan entry system rolled out to 200 employees without proper consent is not one problem. It is potentially 200.
Records are your best defense. Keep your consent logs, retention schedule, and deletion confirmations in one place, and update them whenever a vendor or tool changes. If an inquiry arrives, you want to hand over evidence, not reconstruct it from memory.
Examples of common biometric use cases and what they require
Quick reference by scenario
Rules make more sense when you hold them against real tools. This table maps common setups to the Colorado Privacy Act biometric data requirements, so you can see what each one triggers at a glance.
Use case | Covered? | What you need |
|---|---|---|
Fingerprint time clock | Yes | Notice, consent, retention schedule, timekeeping purpose |
Face-match door entry | Yes | Notice, consent, secure-access purpose, a badge or PIN alternative |
AI video interview scoring | Yes, if it analyzes facial geometry | Notice, consent, and a non-biometric interview option |
Voiceprint login for customers | Yes | Consent before enrollment, a deletion path |
Headshot on a team page | Generally no | Nothing under this amendment, unless used for matching |
Sharing face templates with a data broker | Yes | Separate consent, and in most cases you should not do it |
Reading the pattern
Notice what drives the answer. It is never the brand of the tool. Purpose and consent decide your obligations, and the same camera can be fine in one deployment and risky in another.
The tool does not decide your obligations. Your purpose and your consent record do.
Disclosure deserves extra care. Many vendor contracts let providers reuse templates to "improve the service." That can amount to disclosure you never approved. Read the data-use clause and strike any right to resell or retrain on your users' data.
Before you sign off on any new tool, run one test. Ask whether you could explain the collection to the person being scanned in two sentences. If you cannot, fix the purpose or drop the feature.
What to take away from Colorado's biometric law
The Colorado Privacy Act biometric data rules come down to a few habits. Find every system that scans a face, finger, or voice. Give written notice and separate consent before you collect, and keep only what a stated purpose requires. Employers have less room than many expect, because a scan can be a condition of employment only for narrow purposes. Size is no excuse. Your records of consent, retention, and deletion are your best defense if a regulator asks.
Compliance is the floor, not the goal. The same principle, that people should decide how their face and identity get used, is why we built the Human Authenticity Registry. If you want to see consent-first identity from the individual's side, join the registry as a founding member. It takes about 10 minutes on your phone, and you can ask us to delete your data at any time.