Colorado Expands Reach of Obligations for Processing Biometric Identifiers and Biometric Data

On July 1, 2025, amendments to the Colorado Privacy Act and CPA rules will take effect, significantly expanding the scope of requirements for businesses that control or process biometric identifiers and biometric data. The amendments expand the scope of the law by imposing certain requirements on employers when they collect biometric identifiers or biometric data from their employees (including contractors) or prospective employees.

The new requirements include broader disclosures; the need for consent from both consumers and employees for certain types of biometric processing; restrictions on the sale, purchase, and retention of biometric identifiers and data; and more. Companies that process human characteristics data should evaluate how these amendments may affect their business and take steps to ensure compliance.