Effective July 1, 2025, the Colorado Privacy Act (CPA) is amended (CO H.B. 1130) to require employers to obtain employee consent before collecting and using employees’ biometric information and to adopt a written biometric policy that includes:
- A retention schedule for biometric identifiers and biometric data;
- A Protocol for responding to a data security incident that may compromise the security of biometric identifiers or biometric data; and
- Guidelines that require the deletion of a biometric identifier on or before certain dates.
“Biometric information” under the law means data generated by the technological processing, measurement, or analysis of a consumer’s biological, physical, or behavioral characteristics, which data can be processed to uniquely identify an individual. “Biometric identifier” includes:
- A fingerprint;
- A voiceprint;
- A scan or record of an eye retina or iris;
- A facial map, facial geometry, or facial template; or
- Other unique biological, physical, or behavioral patterns or characteristics.
It is unclear if the state will provide a model policy or consent form. However, the bill does state that the Attorney General’s office may provide rules for the implementation of this amendment.
HR Works will continue to monitor this topic and provide updates as more information is made available.
