Colorado Privacy Act minors' online protections (Privacy Protections for Children's Online Data)

SB 24-041 added a minors' duty of care to the Colorado Privacy Act for online services known to be used by anyone under 18. Without the minor's consent (or a parent's for children under 13), controllers may not use minors' data for targeted ads, sale, or significant profiling, use engagement-extending design features, or collect precise geolocation beyond what is needed. Heightened-risk services need a minors' data protection assessment.