Effective July 1, 2025, Colorado’s Privacy Act expands to impose obligations on any organization handling biometric
identifiers or biometric data, even if previously exempt. Required actions include clear prior notice, informed consent, a
public written policy with retention, deletion, and incident-response guidelines, along with strict deletion timelines and
restrictions on sale, purchase, or dissemination. The amendments also extend limited biometric privacy protections to
employees and job applicants.

Read More Here.