Colorado Privacy Act biological and neural data amendment (Protect Privacy of Biological Data)
CPA neural data (HB 24-1058)
Biometric · Health · Comprehensive privacy
HB 24-1058 made Colorado the first state to add neural data to its privacy law. It defines biological data (including neural data) and treats it as sensitive data, so controllers need opt-in consent and a data protection assessment to process it.
- Where
- Colorado
- Citation
- C.R.S. 6-1-1303(2.2), (16.7), (24)(d)
- Status
- In force
- In force since
- 2024-08-07
- Enforced by
- Colorado Attorney General and district attorneys
- People can sue
- No
- Penalties
- Enforced as a Colorado Privacy Act violation (deceptive trade practice, up to $20,000 per violation).
- Applies to
- Controllers subject to the Colorado Privacy Act that process biological or neural data used for identification purposes
Practices it requires
- Treat biological data, including neural data measured from the central or peripheral nervous system, as sensitive data requiring prior consent.C.R.S. 6-1-1303(2.2), (16.7), (24)(d); 6-1-1308(7)
- Conduct a data protection assessment before processing biological or neural data (processing of sensitive data is heightened risk).C.R.S. 6-1-1309(2)(c)
Sources
- Official text
- Colorado Revised Statutes 2024, Title 6 (Office of Legislative Legal Services, leg.colorado.gov)
- HB24-1058 bill page: Protect Privacy of Biological Data (Colorado General Assembly)
- HB24-1058 session law, Protect Privacy of Biological Data (Colorado General Assembly)
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Definitions apply only where the data is used or intended to be used for identification purposes; whether non-identifying neural data is covered depends on that limit.
Research reference, not legal advice.