(1) 1 On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) that processes a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s personal data in any capacity owes a minimum duty of careMinimum duty of care"Minimum duty of care" means ensuring that the use of the personal data of a covered minor and the design of an online gaming service, product, or feature will not result in: (a) Reasonably foreseeable emotional distress to a covered minor; (b) Reasonably foreseeable compulsive use of the online gaming service, product, or feature by a covered minor; or (c) Discrimination against a covered minor based upon race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.C.R.S. § 6-1-1901(10) to the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8).

(2) Nothing in this section shall be construed to require a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) to prevent or preclude a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) from accessing or viewing any item of media or category of media.

(1)(a)(I)–(VIII) 2 On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall configure all default privacy settings provided to a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) through an online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12) to the highest level of privacy, including the following default settings: (I) Not displaying the existence of the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s account to an adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously allows the adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) to view the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s account or the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously chooses to make their account's existence public; (II) Not displaying media created or posted by the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) to an adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously allows the adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) to view the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s media or the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously chooses to make their media publicly available; (III) Not permitting an adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) to like, comment on, or otherwise provide feedback on the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s media unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously allows the adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) to do so; (IV) Not permitting direct messaging between the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) and an adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously allows direct messaging with the adult userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17); (V) Not displaying the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s location to other usersUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously shares their location with a specific userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17); (VI) Not displaying to any userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) the usersUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) who are connected to the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) unless the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously chooses to share the information with the userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17); (VII) Disabling search engine indexing of the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s account profile; and (VIII) Not sending push notifications to the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8).

(1)(b)(I)–(II) 3 On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall not: (I) Provide a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) with a single setting that makes all of the default privacy settings less protective at once; or (II) Request or prompt a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) to make their privacy settings less protective.

(2)(a)–(b) 4 Timely deletion of account. On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall: (a) Provide a prominent, accessible, and responsive tool to allow a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) to request that the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8)'s account be unpublished or deleted; and (b) Honor a request described in subsection (2)(a) of this section not later than fifteen days after the covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) receives the request.

(1)(a) 5 On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall not: (a) CollectCollect"Collect" means to buy, rent, gather, obtain, receive, or access personal data by any means, including by receiving data, either actively or passively, from a consumer or by observing a consumer's behavior.C.R.S. § 6-1-1901(5), sell, share, or retain personal data of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) that is not necessary to provide an online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12) with which the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) is actively and knowingly engaged;

(1)(b) 6 Use previously collected personal data of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) for any purpose other than a purpose for which the personal data was collected, unless such use is necessary to comply with an obligation under this part 19;

(1)(c) 7 Permit an individual, including a parent or guardian of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8), to monitor the online activity of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) or to track the location of the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) without providing a conspicuous signal to the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) when the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) is being monitored or tracked;

(1)(d)(I)–(III) 8 Use the personal data of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) to select, recommend, or prioritize media for the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8), unless: (I) The covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) expressly and unambiguously requests to receive: (A) Media from a specific account, feed, or userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) or to receive more or less media from an account, feed, or userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17); or (B) A specific category of media or to see more or less of a specific category of media; (II) The personal data is used to set or reset privacy or accessibility settings; or (III) The personal data is used to prioritize media in response to a search query by the covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8);

(1)(e) 9 Send push notifications to a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) between 12 midnight and 6 a.m.

(2) 10 Compulsive useCompulsive use"Compulsive use" means the repetitive use of a covered business's online gaming service, product, or feature, which use: (a) Materially disrupts one or more major life activities of a minor, including sleeping, eating, learning, reading, concentrating, communicating, or working; or (b) Subverts or impairs a covered minor's autonomy, decision-making, or choice during the use of the online gaming service, product, or feature.C.R.S. § 6-1-1901(6). On and after December 1, 2026, a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall not implement data processing or design practices that lead to compulsive use of an online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12).

(1)(a)–(f) 11 On and after December 1, 2026, when conducting age assuranceAge assurance"Age assurance" means a determination, an estimation, or a communication about the age or age range of a user.C.R.S. § 6-1-1901(3), a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) or processor shall: (a) CollectCollect"Collect" means to buy, rent, gather, obtain, receive, or access personal data by any means, including by receiving data, either actively or passively, from a consumer or by observing a consumer's behavior.C.R.S. § 6-1-1901(5) only the personal data of a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) that is necessary for the purpose of age assuranceAge assurance"Age assurance" means a determination, an estimation, or a communication about the age or age range of a user.C.R.S. § 6-1-1901(3); (b) Upon determining that a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) is a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8), immediately delete all data that relates to the determination of the userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)'s age; (c) Not use a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)'s personal data for any purpose other than age assuranceAge assurance"Age assurance" means a determination, an estimation, or a communication about the age or age range of a user.C.R.S. § 6-1-1901(3); (d) Not combine a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)'s personal data with any other userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)'s personal data, except for the purpose of aggregating de-identified data; (e) Not disclose a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)'s personal data to a third party that is not a processor; and (f) Implement a review process to allow a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) to appeal the determination of their age.

(1) 12 A covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall ensure that the purchase price for an online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12) that is made available through the covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7)'s online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12) and that is reasonably likely to be accessed by a covered minorReasonably likely to be accessed by a covered minor"Reasonably likely to be accessed by a covered minor" means an online gaming service, product, or feature that is reasonably likely to be accessed by a covered minor based on any of the following indicators: (a) The online gaming service, product, or feature is directed to children, as described by the federal "Children's Online Privacy Protection Act of 1998", 15 U.S.C. secs. 6501 to 6506, and the associated rules of the Federal Trade Commission; (b) The online gaming service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by an audience that is composed of at least two percent minors who are two through seventeen years old; (c) The audience of the online gaming service, product, or feature is determined, based on internal company research, to be composed of at least two percent minors who are two through seventeen years old; or (d) The covered business knew or should have known that at least two percent of the audience of the online gaming service, product, or feature is composed of minors who are two through seventeen years old; except that, in making this assessment, the business shall not collect or process any personal data that is not reasonably necessary to provide an online gaming service, product, or feature with which a minor is actively and knowingly engaged.C.R.S. § 6-1-1901(16) is listed in United States dollars at the point of sale.

(2) 13 A covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall impose and collectCollect"Collect" means to buy, rent, gather, obtain, receive, or access personal data by any means, including by receiving data, either actively or passively, from a consumer or by observing a consumer's behavior.C.R.S. § 6-1-1901(5) a fee on each add-on transactionAdd-on transaction"Add-on transaction" means an online transaction through which a player or participant in an online gaming service, product, or feature acquires: (a) An item or ability that provides the player or participant an advantage over other players or participants; or (b) A feature that alters or enhances the online gaming service, product, or feature.C.R.S. § 6-1-1901(1) that is conducted by a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) through the covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7)'s online gaming service, product, or featureOnline gaming service, product, or feature"Online gaming service, product, or feature" means an online service, product, or feature, as defined in section 6-1-1303 (16.8), that is intended to facilitate online gaming.C.R.S. § 6-1-1901(12). The amount of the fee is five percent of the amount of the transaction. A covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) shall transfer money collected as fees pursuant to this subsection (2) to the state treasurer, who shall credit the money to the state public school fund created in section 22-54-114.

A covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) or processor that violates this part 19 or rules adopted pursuant to this part 19 commits an unfair or deceptive trade practice as described in section 6-1-105 (1)(qqqq).

(1)(a)–(b) Nothing in this part 19 shall be interpreted or construed to: (a) Impose liability in a manner that is inconsistent with 47 U.S.C. sec. 230; or (b) Prevent or preclude a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) from deliberately or independently searching for, or specifically requesting, any media.

(2)(a)–(d) This part 19 does not apply to: (a) A federal, state, tribal, or local government entity in the ordinary course of its operation; (b) Protected health information that a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) or business associate processes in accordance with, or documents that a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) or business associate creates for the purpose of complying with, the federal "Health Insurance Portability and Accountability Act of 1996", Pub.L. 104-191; (c) Information that is used only for public health activities as described in 45 CFR 164.512; or (d) Information that identifies a userUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17) in connection with: (I) Activities that are subject to the "Federal Policy for the Protection of Human Subjects", as set forth in 45 CFR 46; (II) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use or its successor organization; (III) Activities that are protected under 21 CFR 50 and 56; (IV) Research conducted in accordance with the requirements set forth in subsection (2)(d)(I), (2)(d)(II), or (2)(d)(III) of this section or otherwise in accordance with state or federal law; (V) An entity with a primary purpose of journalism and a workforce whose majority consists of individuals engaging in journalism; or (VI) A financial institution subject to title V of the federal "Gramm-Leach-Bliley Act", Pub.L. 106-102, and regulations adopted to implement that act.

Nothing in this part 19 shall be construed to infringe on the rights and freedoms of covered minorsCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) or be construed to discriminate against a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8) based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.

The attorney general may adopt rules for the implementation of this part 19, including rules establishing permissible methods by which a covered businessCovered business"Covered business" means a sole proprietorship, a partnership, a limited liability company, a corporation, an association, or another legal entity, or an affiliate thereof, that: (a) Conducts business in this state; (b) Generates a majority of its annual revenue from online services; (c) Makes available online gaming services, products, or features that are reasonably likely to be accessed by a covered minor; (d) Collects users' personal data or has users' personal data collected on its behalf by a processor; and (e) Solely or jointly with others determines the purposes and means of the processing of users' personal data.C.R.S. § 6-1-1901(7) may determine the age of a covered minorCovered minor"Covered minor" means a user who a covered business knows is a minor or labels as a minor pursuant to age assurance.C.R.S. § 6-1-1901(8).

(1)(a)–(e) 14 On and after December 1, 2026, a social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e) shall prominently and clearly provide on its website or mobile application: (a) The social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e)'s terms of service, policies, and community standards; (b) The social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e)'s policies concerning usersUser"User" means a user of one or more online gaming services, products, or features who resides in the state.C.R.S. § 6-1-1901(17)' privacy; (c) The purpose of each algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a system that uses an algorithm to select, filter, and arrange media on a social media platform's website or mobile application for the purpose of selecting, recommending, or prioritizing media for a user.C.R.S. § 6-1-1602(2)(a) in use by the social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e); (d) Inputs used by each algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a system that uses an algorithm to select, filter, and arrange media on a social media platform's website or mobile application for the purpose of selecting, recommending, or prioritizing media for a user.C.R.S. § 6-1-1602(2)(a) in use by the social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e), including how each input: (I) Is measured or determined; (II) Uses the personal data of minor usersMinor user"Minor user" means a user of a social media platform who is under eighteen years old.C.R.S. § 6-1-1602(2)(b); (III) Influences a recommendation issued by the system; and (IV) Is weighed relative to the other inputs described in this subsection (1)(d); and (e) For every feature of a website or mobile application that uses the personal data of a minor userMinor user"Minor user" means a user of a social media platform who is under eighteen years old.C.R.S. § 6-1-1602(2)(b), descriptions of: (I) The purpose of the website or mobile application; (II) The personal data collected by the website or mobile application; (III) The personal data used by the website or mobile application; (IV) How the personal data is used by the website or mobile application; (V) Any personal data transferred to or shared with a processor or third party by the website or mobile application, the identity of the processor or third party, and the purpose of the transfer or sharing; and (VI) How long the personal data is retained by the website or mobile application.

(1) 15 A social media platformSocial media platform"Social media platform" has the meaning set forth in section 6-1-1601 (4).C.R.S. § 6-1-1602(2)(e) shall not use an algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a system that uses an algorithm to select, filter, and arrange media on a social media platform's website or mobile application for the purpose of selecting, recommending, or prioritizing media for a user.C.R.S. § 6-1-1602(2)(a) to sell or otherwise distribute an illicit substanceIllicit substance"Illicit substance" means: (A) A controlled substance, as defined in section 18-18-102 (5); (B) A hemp product, as defined in section 25-5-427 (2)(d), that is not a tincture or cosmetic and has more than one and one-fourth milligrams of THC, as defined in section 44-10-209 (2)(d), per serving or has a ratio of cannabidiol to THC of less than twenty to one; and (C) A product that contains hemp that is intended for human consumption and is not a cosmetic, a dietary supplement, a food, a food additive, or an herb. Notwithstanding the foregoing, "illicit substance" does not include: (A) A product that may be produced and sold in Colorado pursuant to and in compliance with section 25-5-427, article 10 of title 44, and rules adopted pursuant to such provisions; or (B) A product that may be produced for personal use or produced and administered for natural medicine services pursuant to and in compliance with article 170 of title 12, section 18-18-434, article 50 of title 44, and rules adopted pursuant to such provisions.C.R.S. § 6-1-1603(2)(b) to a minor userMinor user"Minor user" means a user of a social media platform who is under eighteen years old.C.R.S. § 6-1-1602(2)(b).

(1)(qqqq) A person engages in a deceptive trade practice when, in the course of the person's business, vocation, or occupation, the person: (qqqq) Violates part 19 of this article 1.

(1)(a)(III) Money received as fees pursuant to section 6-1-1906 (2);