Colorado
Colorado has enacted laws in three of the four age-gating families but has not passed a social media minor access or adult content age verification statute. Senate Bill 24-041 amended the Colorado Privacy Act, effective October 1, 2025, to impose a duty of care, data protection assessments, and consent requirements before minors' data is used for targeted advertising, sale, profiling, or engagement extending design features. House Bill 24-1136 required social media platforms to show pop-up warnings to users under 18 after an hour of daily use and at night starting January 1, 2026, but a federal court preliminarily enjoined it on First Amendment grounds in November 2025. Senate Bill 26-051, the Age Attestation on Computing Devices Act, requires operating system providers to collect a birth date, age, or age bracket at device setup and share an age signal with app developers, effective July 1, 2028. Several 2025 and 2026 proposals on adult content age verification (SB 25-201), social media transparency and age verification (SB 24-158), and youth privacy design requirements (HB 25-1287, HB 26-1148) all failed to advance past committee or died when their legislative sessions ended.
Subnational jurisdiction. Reviewed 2026-07-15.
SB 24-041 (2024), Privacy Protections for Children's Online Data
Requires a controller offering an online service, product, or feature to a consumer it actually knows or willfully disregards is a minor (under 18) to use reasonable care to avoid a heightened risk of harm to minors and to conduct data protection assessments. Without consent (the minor's, or a parent's for a child under 13), the controller may not process a minor's data for targeted advertising, sale, or significant profiling, use a system design feature to significantly increase, sustain, or extend the minor's use, or collect precise geolocation except as specified. Signed May 31, 2024.
- Citation
- Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
- Status
- In force
- Effective date
- 2025-10-01
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- parental consent
- Covered services
- Controllers offering any online service, product, or feature to Colorado consumers known or willfully disregarded to be minors, without the Colorado Privacy Act's usual volume thresholds.
- Penalties
- Violations are deceptive trade practices under the Colorado Consumer Protection Act.
- Enforcement body
- Colorado Attorney General and district attorneys
- Private right of action
- no
- Source
- Colo. Rev. Stat. §§ 6-1-1305.5, 6-1-1308.5, 6-1-1309.5 (amending the Colorado Privacy Act)
SB 26-051 (2026), Age Attestation on Computing Devices Act
Requires operating system providers and covered application stores to let an account holder indicate a birth date, age, or age bracket at device setup and to share a real time age signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) with application developers, who must treat the signal as the primary indicator of a user's age range unless they have clear and convincing information otherwise. Signed June 3, 2026; codified as article 30 of title 6 (Age Attestation for Online Users).
- Citation
- Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343)
- Status
- Enacted, not yet in force
- Effective date
- 2028-07-01
- Applies to
- Private sector
- Age threshold
- 18
- Verification methods
- self declaration, device signal
- Covered services
- Operating system providers, covered application stores, and application developers, excluding broadband internet access service, telecommunications service, and open source operating systems.
- Penalties
- Civil penalty up to $2,500 per minor for a negligent violation and up to $7,500 per minor for an intentional violation, with a good faith compliance defense for erroneous age signals.
- Enforcement body
- Colorado Attorney General
- Private right of action
- no
- Source
- Colo. Rev. Stat. §§ 6-30-101 to 6-30-105 (2026 Colo. Sess. Laws ch. 343)
HB 24-1136 (2024), Healthier Social Media Use by Youth
Requires a social media platform with more than 100,000 active Colorado users to give users under 18 information on how social media affects the developing brain and youth mental and physical health, and to display a notification every 30 minutes once a minor has spent one hour on the platform in a 24 hour period or is using it between 10 p.m. and 6 a.m. Signed June 6, 2024, with the platform requirement set for January 1, 2026, but preliminarily enjoined before that date.
- Citation
- Colo. Rev. Stat. § 6-1-1601 (and § 22-2-127.8)
- Status
- Enjoined
- Effective date
- 2026-01-01
- Applies to
- Private sector
- Age threshold
- 18
- Covered services
- Social media platforms with more than 100,000 active users in Colorado that allow user accounts and user generated content.
- Enforcement body
- Colorado Attorney General (Colorado Consumer Protection Act)
- Litigation
- D. Colo. No. 1:25-cv-02538, NetChoice v. Weiser, U.S. District Court for the District of Colorado, Senior Judge William J. Martinez granted NetChoice a preliminary injunction on November 6, 2025, finding the notification requirement likely compels speech in violation of the First Amendment and fails strict scrutiny. The injunction blocked the platform requirement before its January 1, 2026 start date.
- Source
- Colo. Rev. Stat. § 6-1-1601 (and § 22-2-127.8)
Reviewed 2026-07-15. Confidence: high. Fast-moving area, verify before relying. Not legal advice.