Rules that make employers report or explain job cuts linked to AI.
No rule in our checker covers this in Colorado. That does not mean you have no rights: general laws on data protection and discrimination may still apply.
At school and university
2 rules
Rules for AI used by schools, teachers and students.
Explain automated decisions and offer a human review
Before technology that processes personal data materially influences a decision about someone’s job, education, housing, financial or lending services, insurance, health care or essential government services, tell them clearly; a prominent notice where they apply is enough. After a bad outcome, explain its role within 30 days and, on request, let them correct their data and get a human review where commercially reasonable.
Who must do it
Businesses in Colorado that use such technology in decisions about people in Colorado, including workers and job applicants. Developers that sell it must give users documentation and update notices; both keep records for 3 years.
The law
SB 26-189, which replaced the 2024 Colorado AI Act
Who enforces it
Attorney General only, as a deceptive trade practice. Until January 1, 2030, a 60-day chance to fix after a warning, except for knowing or repeated violations. No new right to sue, but discrimination claims still apply.
Let people opt out of profiling that feeds decisions with legal or similarly significant effects, such as on loans, housing, insurance, education or health care. If a human is meaningfully involved you may refuse, but you must then explain the decision, the data used and the logic in plain language. Assess the risks in writing before such profiling.
Who must do it
Businesses serving Colorado residents that handle the data of more than 100,000 of them a year, or of 25,000 or more while earning money or discounts from selling personal data.
The law
Colorado Privacy Act, C.R.S. 6-1-1306(1)(a) and 6-1-1309, with the Attorney General’s rules (4 CCR 904-3, rule 9.04)
Get consent before calling people with an AI voice
Calls that use AI-generated or cloned voices count as artificial-voice calls under the federal robocall law, so they need the called person’s prior express consent, unless it is an emergency or an exemption applies. The message must also identify the caller.
It applies in Colorado because Colorado is part of the United States.
ColoradoFrom January 1, 2027
Tell users your chatbot is AI and handle crises
Tell users clearly that your chatbot is AI at the start of each day’s first chat, at least every three hours or with a notice that stays visible, and whenever they ask. Have a suicide and self-harm protocol that refers users to crisis services, and never present its answers as coming from a licensed professional such as a doctor, lawyer or therapist. Yearly reports to the Attorney General start July 1, 2027.
Who must do it
Operators of public chatbots in Colorado that mainly simulate human conversation. Customer-service, shopping, productivity, developer, school and narrow-topic tools, voice assistants and game bots are excluded.
The law
HB 26-1263 (signed May 29, 2026), section 2
Who enforces it
Attorney General, as a deceptive trade practice under Colorado’s AI law; no new right to sue.
Use reasonable methods to estimate users’ ages, and do not ignore clear signs that a user is a minor. For minors, keep a regular AI notice, give no surprise rewards to drive engagement, block sexual content, stop the bot claiming to be human or sentient or role-playing romance, and give minors and parents privacy and account tools.
Who must do it
Operators of public chatbots in Colorado that mainly simulate human conversation. Customer-service, shopping, productivity, developer, school and narrow-topic tools, voice assistants and game bots are excluded.
The law
HB 26-1263 (signed May 29, 2026), section 2
Who enforces it
Attorney General, as a deceptive trade practice under Colorado’s AI law; no new right to sue.
Do not post or buy fake reviews, including AI-written ones
Do not write, create, sell or buy reviews or testimonials that falsely suggest the reviewer exists, used the product or had the experience described. The FTC says this covers AI-generated fake reviews.
Who must do it
Businesses selling to US consumers.
The law
FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR part 465
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per knowing violation.
It applies in Colorado because Colorado is part of the United States.
United States (all states)In force
Never post AI-made intimate images of real people
It is a federal crime to knowingly publish online an intimate image of an identifiable real person without their consent, including realistic fakes made with AI.
Who must do it
Anyone, people and businesses alike.
The law
TAKE IT DOWN Act (Public Law 119-12), section 2, 47 U.S.C. 223(h)
Who enforces it
Department of Justice; fines and up to two years in prison, or three years if the person shown is a minor.
It applies in Colorado because Colorado is part of the United States.
United States (all states)In force
Remove reported intimate deepfakes within 48 hours
Give people a clear, plain-language way to report intimate images of themselves posted without consent, including AI-made fakes. Remove a valid reported image within 48 hours, and make reasonable efforts to remove known identical copies.
Who must do it
Public websites, apps and online services that mainly host content from users, with no size threshold. Broadband providers and email are excluded.
The law
TAKE IT DOWN Act (Public Law 119-12), section 3
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per violation. Removals made in good faith are protected.
It applies in Colorado because Colorado is part of the United States.
United States (all states)In force
Get parents’ separate consent to train AI on kids’ data
If your site, app or service is aimed at children under 13, or you know you collect their data, get a parent’s separate, verifiable consent before disclosing a child’s personal information to third parties. The FTC says disclosing it to train or develop AI needs this consent.
Who must do it
Operators of websites, apps and online services, including education technology, aimed at children under 13 or knowingly collecting their data.
The law
Children’s Online Privacy Protection Rule, 16 CFR 312.5(a)(2), as amended in 2025
Who enforces it
Federal Trade Commission and state attorneys general; civil penalties of up to $53,088 per violation.