SB 26-070, titled the “Protecting Everyone from Excessive Police Surveillance (PEEPS) Act,” would create a new statutory framework limiting government access to databases that reveal historical location information about individuals or vehicles. The bill generally prohibits government officials from accessing such databases unless they have a valid judicial warrant, the subject gives express consent, the vehicle owner consents after reporting it lost or stolen, exigent circumstances make a warrant impractical, or the access is for narrow operational purposes such as toll collection, traffic enforcement, parking enforcement, or information security. It also bars government entities from sharing historical location information outside their jurisdiction except under limited circumstances, and prohibits selling or conveying the data to private third parties except for very limited vendor maintenance purposes.
The bill further requires any government entity that collects historical location information to adopt a compliance policy with security, approval, recordkeeping, audit, retention, destruction, and training requirements. Those policies must include encryption or comparable protection, supervisor approval before access, detailed logs of each access event, periodic audits at least every 90 days, annual public reporting, and training for personnel. As introduced, the bill also limits retention of collected historical location information to four days unless a warrant, court order, active investigation, or consent authorizes longer retention, after which the information must be destroyed.
The bill would amend Colorado’s public records law to make historical location information not a public record under the Colorado Open Records Act. It also creates an enforcement mechanism for the attorney general and provides that historical location information obtained in violation of the bill is inadmissible in criminal, civil, and administrative proceedings. In addition, political subdivisions would be barred from adopting less restrictive rules, making the bill a statewide floor for privacy protections around location data.
The general sentiment reflected in the bill text is strongly privacy-protective and skeptical of broad surveillance, while still acknowledging law enforcement and emergency exceptions. The legislative declaration emphasizes concerns about overbroad surveillance, secondary use, and access to commercial databases without traditional legal safeguards, but also states that limited exceptions are necessary for public safety. No committee transcript or vote record was provided, so there is no recorded debate or vote history in the materials to indicate support or opposition beyond the bill’s framing.
The main points of contention likely center on the balance between privacy and public safety: whether warrantless access should be allowed in more circumstances, how broad the exceptions should be, whether the retention limits are too restrictive for investigations, and whether the reporting and audit requirements are burdensome for agencies. Another likely issue is the treatment of third-party vendors and whether the bill’s restrictions could interfere with existing law-enforcement tools, traffic systems, or local surveillance practices.
The bill would add a new section to the Colorado criminal procedure statutes governing access to historical location information and would amend the Colorado Open Records Act to exclude that information from public records. It would impose statewide limits on government access, sharing, retention, and disclosure of location databases, require agency compliance policies and audits, authorize attorney general enforcement, and make unlawfully obtained location data inadmissible in proceedings. It would also preempt less protective local policies by political subdivisions.
The bill is framed in strongly pro-privacy terms and reflects concern about surveillance by government entities, especially law enforcement, through commercial and public databases. At the same time, the text expressly preserves narrow exceptions for public safety, emergency response, and certain enforcement functions, suggesting an attempt to balance privacy with operational needs. No votes or committee testimony were provided, so the available record does not show formal opposition or support beyond the bill’s stated policy rationale.
Likely areas of contention include whether a warrant should be required for most access, whether the exceptions for exigent circumstances and operational uses are too broad, and whether the four-day retention limit is workable for investigations. Agencies may also object to the mandatory logging, audit, training, and public reporting requirements, while privacy advocates are likely to support those safeguards and the ban on sharing or selling data to third parties. The bill’s preemption of less restrictive local rules may also be a point of tension for local governments and law enforcement agencies.