Effective July 1, 2025, the Colorado Privacy Act (CPA) is amended (CO H.B. 1130) to require employers to obtain employee consent before collecting and using employees’ biometric information and to adopt a written biometric policy that includes:
- A retention schedule for biometric identifiers and biometric data;
- A protocol for responding to a data security incident that may compromise the security of biometric identifiers or biometric data; and
- Guidelines that require the deletion of a biometric identifier on or before certain dates.
What is Biometric Information?
Under the law, “biometric information” refers to data generated through the technological processing, measurement, or analysis of a consumer’s biological, physical, or behavioral characteristics that can be used to uniquely identify an individual. A “biometric identifier” includes:
- A fingerprint;
- A voiceprint;
- A scan or record of an eye retina or iris;
- A facial map, facial geometry, or facial template; or
- Other unique biological, physical, or behavioral patterns or characteristics.
Consent Requirements
Employers must obtain affirmative and voluntary consent from applicants and employees before collecting or using biometric identifiers for non-job duty-related purposes and cannot retaliate if consent is withheld; new consent is also required upon hire. Consent is not required when biometric collection is a job duty expectation (such as for security access) or necessary for application, background check, or identification processes.
Employers can also make consent a condition of employment for the following common uses of biometric identifiers:
- To grant access to physical locations (e.g., fingerprint access to enter a building)
- To secure electronic hardware and software applications
- For timekeeping purposes
- For workplace or public safety and security purposes
Next Steps for Employers
It is currently unclear whether the state will issue a model policy or consent form, although the bill authorizes the Attorney General’s office to adopt rules for implementation. Uncertainty also remains regarding the law’s applicability to employment records, as the Colorado Privacy Act excludes data maintained for employment purposes. In the interim, employers that collect biometric information should be prepared to develop and implement a policy and procedures for obtaining consent from applicants and employees.
HR Works will continue to monitor this topic and provide updates as more information is made available.
