HB1037 would prohibit law enforcement agencies and other government entities in Colorado from obtaining or receiving access to certain personal data from third parties in exchange for money or other value. The bill defines personal data broadly to include items such as names, addresses, Social Security numbers, browsing and search history, geolocation data, financial and health information, biometric and biological data, device identifiers, communications content, and profiles or inferences derived from third-party data. It also bars government entities from sharing with one another personal data that was obtained from a third party for value, and it limits the use of such data in criminal, civil, and other investigatory or enforcement activities.
The bill creates several exceptions. Government entities could still obtain the data with a judicial warrant, subpoena, or court order; in a good-faith emergency involving risk of death or serious bodily injury; when the information is already publicly available through government records or widely distributed media; when the individual expressly consents; or in certain missing- and exploited-child investigations involving the National Center for Missing and Exploited Children. It also allows individuals to bring a private civil action for injunctive, declaratory, or other relief, including attorney fees, if the law is violated. In addition, courts would generally be required to exclude personal data obtained in violation of the bill, and the bill clarifies that its provisions do not authorize location-data purchases that would violate the new restrictions.
The bill’s impact on state law would be significant for Colorado criminal procedure, privacy enforcement, and evidence rules. It adds a new section to the Colorado Revised Statutes restricting government acquisition of data from brokers or other third parties, and it amends the existing location-information statute to make clear that warrant rules do not override the new ban on paid third-party data acquisition. The measure would also create a new private right of action and an exclusionary rule-like remedy for unlawfully obtained data, affecting how prosecutors and other government litigants can use such information in court.
The general sentiment reflected in the available voting history appears mixed and closely divided. In House Judiciary, an amendment was adopted 6-4, but a later motion to refer the bill, as amended, to Appropriations failed on a 5-5 tie, and a motion to postpone the bill indefinitely also failed on a 5-5 tie. That pattern suggests substantial support for the bill’s privacy goals, but also significant concern about its scope, implementation, and fiscal or operational consequences.
The main point of contention is the balance between privacy protections and government investigative authority. Supporters are likely focused on limiting warrantless access to sensitive digital data and preventing government circumvention of constitutional protections through data purchases. Opponents or skeptics appear to be concerned about restricting law enforcement tools, the breadth of the definition of personal data, the bill’s exclusionary and civil-liability provisions, and whether the exceptions are sufficient to preserve effective investigations and emergency response.
HB1037 would add a new statutory prohibition on government purchase or other paid acquisition of personal data from third parties, and would also bar sharing of such data between government entities when the data was obtained for value. It would create a private cause of action, authorize injunctive and declaratory relief and attorney fees, and require courts to exclude data obtained in violation of the section, subject to limited exceptions. The bill also amends Colorado’s location-information statute to ensure it does not authorize conduct prohibited by the new section.
The available committee votes show a sharply divided response. An amendment was adopted, but subsequent motions to advance or kill the bill both failed on 5-5 ties, indicating no clear consensus. Overall, the bill appears to have support from privacy-focused members and resistance from members concerned about law-enforcement impacts and the bill’s practical effects.
The central dispute is whether government entities, especially law enforcement, should be barred from buying sensitive data from brokers and other third parties as a workaround to warrant requirements. Supporters emphasize privacy, Fourth Amendment principles, and limits on digital surveillance; opponents are likely worried about hampering investigations, creating litigation risk, and imposing broad evidence-exclusion rules. The breadth of the definition of personal data and the scope of exceptions, including consent, public availability, and emergency access, are also likely areas of concern.