Colorado biometric data at work: what HB24-1130 lets employers require, and what needs a worker's free consent

Colorado added biometric rules to the Colorado Privacy Act with House Bill 24-1130, which created section 6-1-1314 of the Colorado Revised Statutes and took effect on 1 July 2025 (HB24-1130, signed act). Unlike most state biometric laws, it has a subsection written specifically for employers, which sets out the uses an employer can make a condition of the job and the uses that need a worker's free choice. This page explains what the signed text says.

The short answer: an employer may require consent to collect and process a worker's biometric identifier as a condition of employment only for secure access, recording the start and end of the work day, workplace safety or security, and public safety in an emergency. Any other use needs the worker's consent, and the employer may not make that consent a condition of the job or retaliate against a worker who says no (6-1-1314(6)(a)-(b)). Any controller that holds biometric identifiers also needs a written retention and deletion policy (6-1-1314(2)).

What is covered

• Biometric identifier: data generated by the technological processing, measurement or analysis of a person's biological, physical or behavioral characteristics that can be processed to uniquely identify them, including a fingerprint, a voiceprint, a scan of an eye retina or iris, a facial map, geometry or template, and other unique biological, physical or behavioral patterns (6-1-1303(2.4)).
• Biometric data: one or more biometric identifiers used or intended to be used for identification. Photographs, audio or voice recordings and data generated from photos or recordings are excluded unless they are used for identification (6-1-1303(2.2)).
• Employee: a person employed full-time, part-time or on call, or hired as a contractor, subcontractor, intern or fellow (6-1-1314(1)(b)).
• No size threshold for biometrics: the Colorado Privacy Act normally applies only to controllers above set data volumes, but the act extends it to any controller that controls or processes any amount of biometric identifiers or biometric data. A controller below the usual thresholds must comply only for the biometric data it collects and processes (6-1-1304(1)(b)).

The employer rules

• Uses that can be required: consent can be a condition of employment only to permit access to secure physical locations and secure electronic hardware and software, to record the start and end of the employee's full work day, including meal and rest breaks over 30 minutes, to improve or monitor workplace safety or security or the safety of employees, and to protect the public in an emergency or crisis (6-1-1314(6)(a)).
• No tracking through the access exception: the access exception does not let an employer obtain consent to retain biometric data used for tracking where a current employee is, or how much time an employee spends using a hardware or software application (6-1-1314(6)(a)(I)).
• Everything else is optional for the worker: other uses need the employee's or applicant's consent, which cannot be required as a condition of employment, and the employer may not retaliate against someone who does not consent (6-1-1314(6)(b)).
• Reasonable expectations: the section does not restrict collection and processing for uses aligned with an employee's reasonable expectations based on their job description or role, or an applicant's based on a reasonable background check, application or identification requirements (6-1-1314(6)(d)).

Duties for any controller

• Written policy: a retention schedule, a protocol for security incidents including notifying people of a breach, and deletion of a biometric identifier by the earliest of three dates: when the initial purpose has been satisfied, 24 months after the person last interacted with the controller, or within 45 days (extendable by 45 more) after an annual review finds it is no longer needed (6-1-1314(2)(a)). The policy must be public, except a policy that applies only to current employees, an internal operating policy, or the incident protocol (6-1-1314(2)(b)).
• Tell people first: before collecting, a controller must say clearly that a biometric identifier is being collected, for what specific purpose, how long it will be kept, and whether and why it will be shared with a processor (6-1-1314(4)(a)).
• No sale: a controller may not sell, lease or trade biometric identifiers, and may disclose them only with consent, to complete a financial transaction the person requested, to a processor where necessary for the consented purpose, or where state or federal law requires it (6-1-1314(4)(b)).
• Vendors: a processor must have its own incident protocol, including telling the controller about a breach (6-1-1314(3)), and both must protect identifiers to the standard of care in the controller's industry (6-1-1314(4)(d)).

The Colorado Department of Law may make rules for this section, including security standards stricter than the statute (6-1-1314(7)). The section heading mentions remedies and civil actions, but the signed text contains no subsection creating a private lawsuit.

What this means in practice

• Employers: sort every biometric use into the four required-consent purposes or the optional group. Time clocks and door access can be a condition of the job; other uses, such as identity checks in productivity tools, need a real choice with no penalty for refusing. Write the retention and deletion policy and check processors' breach terms.
• Workers: you can be required to use a fingerprint or face scan to clock in or open secure doors, but not for other purposes. You can say no to those without retaliation, and you should be told the purpose and how long the data is kept.

Colorado also bars employers from asking for personal account logins: see the Colorado social media password law. Compare Illinois BIPA at work, the Texas biometric law at work and the Washington biometric law at work. For Colorado's AI rules, see the Colorado automated decision law, for workplace surveillance more widely, US employee monitoring laws, and for GPS trackers in vehicles, New Jersey's vehicle tracking notice rule. For all four state biometric laws side by side, see biometric privacy laws at work compared.

This page covers Colorado and is general information based on the signed text of HB24-1130 published by the Colorado General Assembly when checked on 3 November 2026, not legal advice.