Concerning prohibiting a government entity from obtaining certain personal data from a third party for use by a government entity in exchange for anything of value.
HB26-1037 would restrict Colorado law enforcement and other government entities from buying, licensing, or otherwise obtaining certain personal data from third parties in exchange for money or other value. The bill defines personal data broadly to include items such as names, addresses, Social Security numbers, browsing and search history, precise geolocation, financial and health information, biometric and biological data, device identifiers, communications content, and profiles or inferences derived from third-party data.
The bill also bars government entities from sharing with other government agencies personal data that was originally obtained from a third party for value, and it limits the use of such data in criminal, civil, or other investigative or enforcement activity. It creates exceptions for judicial warrants, subpoenas, or court orders; emergencies involving risk of death or serious bodily injury; publicly available information; data voluntarily made public by the individual; express consent; and missing or exploited child investigations. It further creates a private right of action for injured individuals and generally excludes data obtained in violation of the bill from trial or other proceedings, subject to limited exceptions.
If enacted, the bill would add a new section to Colorado criminal procedure law and amend the state’s location-information statute to reinforce that government entities cannot circumvent warrant requirements by purchasing data from brokers or other third parties. It would affect law enforcement agencies, prosecutors, and other government entities that rely on commercially available data, and it would create potential civil liability and evidentiary consequences for violations. The bill would also strengthen privacy protections in state law by limiting intergovernmental sharing of purchased personal data and by making unlawfully obtained data inadmissible in court absent specified documentation.
The bill’s stated purpose and structure reflect a strong privacy-protection sentiment, emphasizing Fourth Amendment principles and Colorado constitutional privacy protections. The introduction suggests support from sponsors in both parties, indicating some bipartisan interest in limiting government access to commercially traded personal data. However, the bill was ultimately postponed indefinitely in the House Judiciary Committee, which indicates that, despite the privacy rationale, it did not advance and likely faced sufficient concern or lack of consensus to halt progress.
The main points of contention are likely to have centered on whether law enforcement should be barred from purchasing data that is otherwise available from brokers, and whether the bill would unduly limit investigative tools in criminal and emergency contexts. Opponents or skeptics may have been concerned about practical impacts on public safety, interagency cooperation, and the admissibility of evidence, while supporters would have emphasized privacy, warrant requirements, and preventing circumvention of constitutional protections. The exceptions for warrants, emergencies, public data, consent, and missing-child investigations appear designed to address those concerns, but the committee’s decision to postpone indefinitely suggests unresolved disagreement over the balance between privacy rights and enforcement needs.