Bill > SB051

This bill establishes a framework for "age attestation" on computing devices in Colorado, aiming to better protect minors online by allowing operating system providers and application stores to signal a user's age bracket to applications. Starting July 1, 2028, operating system providers must offer an interface during account setup where account holders (individuals 18 or older, or parents/guardians of minors) can indicate the user's birth date, age, or age bracket, which is then transmitted as an "age signal" to "covered applications" (consumer software applications downloaded from a "covered application store," excluding those that don't process personal data or are from public code repositories). Developers of these covered applications must use this age signal to comply with applicable laws, such as the "Colorado Privacy Act" (CPA), which already imposes stricter rules for processing minors' personal data, and can only request the minimum necessary information. The bill defines key terms like "account holder," "age-bracket data," "age signal," "covered application," and "minor" (under 18), and includes provisions for existing devices and enforcement, with penalties for violations ranging from $2,500 to $7,500 per minor harmed, though good-faith efforts to comply are considered. The legislation explicitly states it does not modify antitrust laws or require the collection of unnecessary personal data, and outlines specific exclusions, such as for broadband internet services, telecommunications services, and certain enterprise or open-source software.