Colorado Privacy Act biometric amendments (Privacy of Biometric Identifiers and Data)

HB 24-1130 added biometric-specific duties to the Colorado Privacy Act, reaching any controller that handles biometric identifiers regardless of size and covering employees. Controllers need a public written retention and deletion policy, advance notice, consent, and may not sell biometric identifiers. Employers may require consent only for listed purposes such as secure access, timekeeping, and safety.