US States · 3 laws · 14 requirements
Colorado: the laws your website or app must follow
If your customers are in Colorado, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
Coming up in Colorado
- 2027-01-01 · Colorado ADMT law (SB 26-189, from 1 Jan 2027): Signed 14 May 2026, repealing and replacing the 2024 Colorado AI Act (SB 24-205); applies to decisions made from 1 Jan 2027. The Attorney General enforces it (no private lawsuits), must adopt rules by 1 Jan 2027, and gives a 60-day chance to fix a violation where a fix is possible until 1 Jan 2030.
- 2027-01-01 · Colorado chatbot law (HB 26-1263): Operator duties apply from 1 Jan 2027 and the annual report to the Attorney General from 1 Jul 2027.
- 2027-07-01 · Colorado chatbot law (HB 26-1263): Operator duties apply from 1 Jan 2027 and the annual report to the Attorney General from 1 Jul 2027.
- 2030-01-01 · Colorado ADMT law (SB 26-189, from 1 Jan 2027): The Attorney General enforces it (no private lawsuits), must adopt rules by 1 Jan 2027, and gives a 60-day chance to fix a violation where a fix is possible until 1 Jan 2030.
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
Colorado Privacy Act
In force since 1 July 2023; children's data amendments since 1 Oct 2025.
Who it covers: Businesses handling data of 100,000+ Coloradans a year, or 25,000+ while earning revenue from selling data.
What it requires of a website or app (6)
- A privacy notice: categories, purposes, rights and appeal, sharingCheckedC.R.S. §6-1-1308(1)
- Honour universal opt-out signals such as Global Privacy ControlAI review§6-1-1306(1)(a)(IV); Rule 5
- Rights to access, correct, delete, port and opt out; appealsChecked§6-1-1306
- Consent for sensitive data; no dark patterns in consentYour answers§6-1-1308(7); Rule 7
- Reasonable securityChecked§6-1-1308(5)
- Data protection assessments for high-risk processingPrepared§6-1-1309
Colorado ADMT law (SB 26-189, from 1 Jan 2027)
Signed 14 May 2026, repealing and replacing the 2024 Colorado AI Act (SB 24-205); applies to decisions made from 1 Jan 2027.
Who it covers: Developers and deployers of automated decision-making technology that materially influences consequential decisions (jobs, housing, credit, education, health care, insurance, government services).
What it requires of a website or app (3)
- Tell consumers when ADMT influences a consequential decision about them (if if AI influences such decisions)Your answersC.R.S. 6-1-1704(1)–(2)
- Explain adverse decisions within 30 days and offer meaningful human review where commercially reasonable (if if AI influences such decisions)Your answersC.R.S. 6-1-1704(3), 6-1-1705(1)
- Keep the records the law requires (deployers: at least three years after the decision) (if if AI influences such decisions)Your answersC.R.S. 6-1-1703
Colorado chatbot law (HB 26-1263)
Signed 29 May 2026 (HB 26-1263, Ch.
Who it covers: Operators of a conversational AI service open to the general public that mainly simulates human conversation. Customer-service and shopping assistants, tools for developers or businesses, and a chatbot that is just a feature inside another app are excluded.
What it requires of a website or app (5)
- Clearly tell every user the service is AI: at the start of their first conversation each day, at least every 3 hours in a long session (or a permanent visible notice), and whenever they ask if it is human (if if you offer a public AI chatbot or companion to Colorado users as a product in itself, not a customer-service or shopping assistant or a feature inside another app)AI reviewC.R.S. 6-1-1708(3)
- Respond to prompts about suicidal thoughts or self-harm with a referral to a crisis service, and escalate repeated or severe signs (if if you offer a public AI chatbot or companion to Colorado users as a product in itself, not a customer-service or shopping assistant or a feature inside another app)AI reviewC.R.S. 6-1-1708(4)
- Never say or imply that the chatbot's answers come from, or equal those of, a licensed health-care, legal or mental-health professional or a dietitian (if if you offer a public AI chatbot or companion to Colorado users as a product in itself, not a customer-service or shopping assistant or a feature inside another app)AI reviewC.R.S. 6-1-1708(5)
- Estimate users' age and, for users you know are minors, add a visible AI notice, block sexual content, avoid engagement rewards at unpredictable intervals, limit emotional-dependence behaviour and give privacy and parental tools (if if you offer a public AI chatbot or companion to Colorado users as a product in itself and minors may use it)AI reviewC.R.S. 6-1-1708(2)
- Send the Attorney General the yearly report on crisis referrals and protocols (no user identifiers), from 1 Jul 2027 (if if you offer a public AI chatbot or companion to Colorado users as a product in itself)You confirmC.R.S. 6-1-1708(6)
Sources:HB26-1263 (Colorado General Assembly) HB26-1263 Final Act text
Check your site against Colorado's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.