Concerning age attestation for users of computing devices.
Summary
SB26-051 creates a new Colorado law on age attestation for users of computing devices and applications. It requires operating system providers to build an accessible account-setup interface that captures a user’s birth date or age and converts that information into an “age signal” or age-bracket data that can be shared with applications through a real-time API. Developers of applications distributed through covered application stores must request that age signal when an app is downloaded and launched, and they must use it as the primary indicator of the user’s age range unless they have clear and convincing information showing a different age.
The bill is designed to give developers a standardized, nonpersonalized way to determine whether a user is a minor or falls into a specific age bracket, including under 13, 13-15, 16-17, or 18 and older. It also limits the amount of information that can be collected or shared, and it prohibits operating system providers and developers from disclosing age signals to third parties for purposes not required by the act. The law applies prospectively beginning January 1, 2028, with a transition period for existing devices and certain older apps that must be brought into compliance by July 1, 2028.
Impact
The bill adds article 30 to title 6 of the Colorado Revised Statutes, imposing new duties on operating system providers, covered application stores, and app developers. It establishes a civil enforcement scheme under which the attorney general may seek penalties of up to $2,500 per minor for negligent violations and up to $7,500 per minor for intentional violations. The act also includes limits on liability for good-faith compliance, preserves antitrust laws, and exempts certain categories such as broadband and telecommunications services, physical products, government and higher-education data, enterprise communications software, enterprise software sales, and technical support tools.
Sentiment
The bill appears to have been viewed as a consumer- and child-protection measure focused on age verification/age attestation in digital environments, with no recorded committee transcript or vote history in the provided materials indicating organized opposition or support. Its final status as signed by the governor suggests it ultimately received sufficient legislative and executive approval. The structure of the bill, including privacy limits and technical-compliance language, suggests an effort to balance child-safety goals with concerns about data minimization and implementation feasibility.
Contention
The main points of potential contention are privacy, technical feasibility, and the burden placed on platform operators and app developers. Critics could object that the bill requires collection of age-related information at account setup and creates a new compliance layer for app distribution, while supporters would likely emphasize that only the minimum necessary information may be shared and that age signals are nonpersonally identifiable. Another likely point of debate is the bill’s broad reach across operating systems and application stores, along with the rule that developers are deemed to know the user’s age range once they receive an age signal, which could affect liability and product design. The bill attempts to address these concerns through exemptions, nondiscrimination requirements, and a good-faith safe harbor.