In May 2024, Colorado Governor Jared Polis signed into law Senate Bill 41, which amends the Colorado Privacy Act (CPA) to create new requirements specifically targeting minors’ use of online services and products. Importantly, the law establishes a duty of care to avoid any heightened risk of harm to minors online and regulates the use of online targeted behavior advertising impacting individuals under the age of 18. Unlike the CPA, SB 41 does not have revenue or processing thresholds and, therefore, its requirements apply to more businesses. The amendments take effect on October 1, 2025.
Definitions
For purposes of SB 41, the following key terms apply:
“Minor” means any consumer who is under 18 years of age. This is important as many data protection laws, including the Children’s Online Privacy Protection Act of 1998 (COPPA), define a minor as a child under the age of 13.
“Online service, product, or feature" means any service, product, or feature provided online. It does not include telecommunications service, broadband internet access service, or the delivery or use of a physical product.
“Precise geolocation data” means information derived from technology that identifies the specific location of an individual within a radius of 1,750 feet. Unique to Colorado, any service or application used by, or under the direction of, a ski area operator is not subject to restrictions on geolocation data.
Heightened Risk of Harm to Minors
Under SB 41, any business offering an online service, product, or feature to a consumer whom the controller actually knows or willfully disregards as being a minor has a duty to use reasonable care to avoid any heightened risk of harm to minors caused by the online service, product, or feature. An online service, product or feature does not include telecommunication services.
SB 41 defines heightened risk of harm as processing the personal data of minors in a manner that presents a reasonably foreseeable risk that could cause:
- unfair or deceptive treatment of minors or unlawful disparate impact on them,
- financial, physical, or reputational injury to minors,
- unauthorized disclosure of the personal data of minors because of a security breach, or
- physical or other intrusion into the solitude or private affairs of minors that would be offensive to a reasonable person.
Prohibited Activities
Without a minor’s consent (or the consent of the appropriate parent or guardian), SB 41 prohibits processing a minor’s personal data for:
- targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.
- any processing purpose other than what was disclosed at the time of collection, or that is not reasonably necessary and compatible with the disclosed purpose.
- for processing longer than is reasonably necessary.
Controllers are prohibited from using system design features to significantly increase, sustain, or extend a minor's online service, product, or feature use.
Controllers cannot offer any direct messaging platform for use by a minor without providing readily accessible and easy-to-use safeguards to limit the ability of an adult to send unsolicited communications to the minor. This provision does not apply to e-mail, direct messaging not posted publicly, or any service provided at the direction of an educational entity.
Geolocation Data
The collection of precise geolocation data of minors is prohibited without a minor’s consent (or in the case of a child, the consent of the parent or guardian) and:
i. precise geolocation data is reasonably necessary for the controller to provide the online service, product, or feature,
ii. the controller only collects and retains the precise geolocation data for the time necessary to provide the online service, product, or feature, and
iii. the controller provides a signal to the minor indicating that the controller is collecting precise geolocation data and that the signal is available to the minor for the entire duration of the collection.
Age Verification and Parental Consent
Complying with verifiable parental consent requirements as laid out in COPPA sufficiently satisfies the parental consent requirements under SB 41.
The new law does not require controllers or processors to implement age verification or gating systems, and controllers that conduct commercially reasonable age estimations are not liable for errors in those estimations.
Existing CPA Requirements
SB 41 mimics and references several existing obligations of processors and controllers but is tailored toward the data of minors. A processor must adhere to the instructions of a controller and assist the controller in meeting the controller's obligations. This includes entering a sufficient contract with the controller, having appropriate technical and organizational measures to protect the data of a minor, and providing necessary information for the controller to conduct a data processing assessment of a minor’s personal data.
Data processing assessments are also reiterated in SB 41, requiring such an assessment to outline the categories of a minor’s personal data, the purposes for processing the minor’s personal data, and the foreseeable heightened risk of harm to the minor.
This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.
This document may be considered attorney advertising in some jurisdictions. © 2024 THOMPSON HINE LLP. ALL RIGHTS RESERVED.
