Privacy & Cybersecurity Law Blog

On May 7, 2025, the Colorado legislature passed a bill to protect the civil rights of persons in Colorado based on immigration status, (S.B. 276), which, if signed into law, would amend the Colorado Privacy Act (“CPA”). The bill awaits signature by Colorado Governor Jared Polis.

The bill would amend the CPA’s definition of “sensitive data” to include precise geolocation data, and would amend the definition of “precise geolocation data” from information derived from technology, including global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of [1,750] feet to global positioning system (GPS) coordinates within a radius of [1,850] feet; or any data derived from a device and that is used or intended to be used to locate a consumer within a geographic area within a radius of [1,850] feet.

The definition of “precise geolocation data” would exclude the content of communications or “any data generated by or connected to advanced utility meeting infrastructure systems or equipment for use by a utility.”

The bill also would amend the CPA to prohibit controllers from “selling” consumer’s sensitive data without first obtaining consumers’ prior affirmative consent. Note that the current version of the CPA already prohibits the “processing” of consumers’ sensitive data without consent, which term is defined to include the “sale” of personal data, but this amendment would make this requirement more explicit.