Read the full stored bill text
Second Regular Session
Seventy-fifth General Assembly
STATE OF COLORADO
INTRODUCED
LLS NO. 26-0292.02 Owen Hatch x2698 HOUSE BILL 26-1037
House Committees Senate Committees
Judiciary
A BILL FOR AN ACT
CONCERNING PROHIBITING A GOVERNMENT ENTITY FROM OBTAINING101
CERTAIN PERSONAL DATA FROM A THIRD PARTY FOR USE BY A102
GOVERNMENT ENTITY IN EXCHANGE FOR ANYTHING OF VALUE.103
Bill Summary
(Note: This summary applies to this bill as introduced and does
not reflect any amendments that may be subsequently adopted. If this bill
passes third reading in the house of introduction, a bill summary that
applies to the reengrossed version of this bill will be available at
http://leg.colorado.gov.)
The bill prohibits law enforcement and other government entities
from purchasing, or otherwise obtaining for anything of value, certain
personal data from third parties. Law enforcement agencies and other
government entities are also prohibited from sharing individuals' personal
data between themselves.
HOUSE SPONSORSHIP
Bacon and DeGraaf,
SENATE SPONSORSHIP
Cutter,
Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.
Capital letters or bold & italic numbers indicate new material to be added to existing law.
Dashes through the words or numbers indicate deletions from existing law.
Exceptions are created for obtaining personal data, including after
obtaining a judicial warrant, subpoena, or court order, when an individual
consents to sharing their data and, in the case of an emergency, involving
a threat to a person's life or physical safety.
The bill creates a private cause of action for an individual who has
their personal data obtained or shared in violation of the prohibitions in
the bill. Personal data obtained or shared is excluded from trial and other
court proceedings, subject to certain exceptions.
Be it enacted by the General Assembly of the State of Colorado:1
SECTION 1. Short title. The short title of this act is the "Fourth2
Amendment is Not for Sale Act".3
SECTION 2. Legislative declaration. (1) The general assembly4
finds and declares that:5
(a) The fourth amendment to the United States constitution6
guarantees that "[t]he right of the people to be secure in their persons,7
houses, papers, and effects, against unreasonable searches and seizures,8
shall not be violated, and no Warrants shall issue, but upon probable9
cause, supported by Oath or affirmation, and particularly describing the10
place to be searched, and the persons or things to be seized";11
(b) The United States supreme court has observed, "Few12
protections are as essential to individual liberty as the right to be free13
from unreasonable searches and seizures. The Framers made that right14
explicit in the Bill of Rights following their experience with the15
indignities and invasions of privacy wrought by general warrants and16
warrantless searches that had so alienated the colonists and had helped17
speed the movement for independence. Ever mindful of the Fourth18
Amendment and its history, the Court has viewed with disfavor practices19
that permit police officers unbridled discretion to rummage at will among20
a person's private effects." Byrd v. United States, 584 U.S. 395, 402-40321
HB26-1037-2-
(2018). Accordingly, "As technology has enhanced the Government's1
capacity to encroach upon areas normally guarded from inquisitive eyes,2
[the United States Supreme] Court has sought to assure preservation of3
that degree of privacy against government that existed when the Fourth4
Amendment was adopted." Carpenter v. United States, 585 U.S. 296, 3055
(2018).6
(c) In People v. Seymour, 536 P.3d 1260 (Colo. 2023), the7
Colorado supreme court stated that Colorado is not bound by the United8
States supreme court's interpretation of the fourth amendment when9
determining the scope of state constitutional protections. The court stated10
that article II, section 7 provides even greater privacy protections than the11
fourth amendment, and Colorado has "long rejected the third-party12
doctrine under that provision of the Colorado Constitution," further13
stating that "[g]iven the enduring and related privacy concerns presented14
by a search of an individual's online search history, we see no reason to15
change course here."16
(d) Law enforcement has been able to effectively and efficiently17
enforce our criminal laws for more than 230 years without needing to18
evade fourth amendment warrant requirements that are essential to19
protecting Americans' liberty and privacy in the digital age.20
SECTION 3. In Colorado Revised Statutes, add 16-3-303.3 as21
follows:22
16-3-303.3. Prohibition on the bulk purchase of data from23
third parties by law enforcement - evidence inadmissible in court -24
definitions.25
(1) AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE26
REQUIRES:27
HB26-1037-3-
(a) "EXCHANGE FOR ANYTHING OF VALUE" MEANS TO OBTAIN OR1
RECEIVE ACCESS TO AN ITEM, DATA, OR INFORMATION:2
(I) I N EXCHANGE FOR MONEY OR OTHER VALUABLE3
CONSIDERATION;4
(II) I N CONNECTION WITH SERVICES OR BENEFITS PROVIDED AS5
CONSIDERATION; OR6
(III) AS PART OF THE PROVISION OF A FEE, INCLUDING AN ACCESS7
FEE, SERVICE FEE, MAINTENANCE FEE, OR LICENSING FEE.8
(b) "GOVERNMENT ENTITY" HAS THE SAME MEANING SET FORTH9
IN SECTION 16-3-303.5, INCLUDING A POLITICAL SUBDIVISION.10
(c) "LAW ENFORCEMENT ENTITY" MEANS AN AGENCY OR OTHER11
INSTRUMENTALITY OF A GOVERNMENT ENTITY, INCLUDING AN EMPLOYEE12
OR AGENT OF THE ENTITY, THAT IS AUTHORIZED BY LAW, REGULATION, OR13
GOVERNMENTAL POLICY TO ENGAGE IN OR SUPERVISE THE PREVENTION ,14
DETECTION, INVESTIGATION , OR PROSECUTION OF A VIOLATION OF15
CRIMINAL LAW.16
(d) "PERSONAL DATA" MEANS INFORMATION COLLECTED FROM OR17
GENERATED BY A SPECIFIC PERSON AS PART OF A CONSUMER TRANSACTION18
OR THE USE OF A CONSUMER PRODUCT OR SERVICE , WHETHER THE19
INFORMATION WAS COLLECTED BY THE ORIGINAL THIRD PARTY OR20
OBTAINED BY A DIFFERENT THIRD PARTY , THAT IS CONNECTED OR21
REASONABLY CONNECTED TO THE SPECIFIC PERSON OR THE SPECIFIC22
PERSON'S ELECTRONIC DEVICE . PERSONAL DATA INCLUDES , BUT IS NOT23
LIMITED TO, A PERSON'S:24
(I) NAME;25
(II) BILLING INFORMATION OR ADDRESS;26
(III) SOCIAL SECURITY NUMBER;27
HB26-1037-4-
(IV) HOME ADDRESS;1
(V) DEMOGRAPHIC DATA;2
(VI) WEB BROWSING OR SEARCH HISTORY;3
(VII) APPLICATION USAGE HISTORY;4
(VIII) P RECISE GEOLOCATION DATA , AS DEFINED IN SECTION5
6-1-1303;6
(IX) FINANCIAL INFORMATION;7
(X) HEALTH INFORMATION;8
(XI) BIOMETRIC IDENTIFIER, AS DEFINED IN SECTION 6-1-1303;9
(XII) BIOLOGICAL DATA, AS DEFINED IN SECTION 6-1-1303;10
(XIII) CHARACTERISTICS OF PROTECTED CLASSIFICATIONS UNDER11
STATE OR FEDERAL LAW;12
(XIV) DEVICE IDENTIFIER, INCLUDING A MEDIA ACCESS CONTROL13
ADDRESS, INTERNATIONAL MOBILE EQUIPMENT IDENTIFIER, OR INTERNET14
PROTOCOL ADDRESS;15
(XV) COMMUNICATIONS CONTENT; AND16
(XVI) PROFILES OR INFERENCES ABOUT AN INDIVIDUAL BASED ON17
DATA POINTS COLLECTED OR ACQUIRED FROM THIRD PARTIES.18
(e) "THIRD PARTY" MEANS A PERSON WHO:19
(I) IS NOT A GOVERNMENT ENTITY; AND20
(II) IS NOT THE PERSON TO WHOM THE PERSONAL DATA PERTAINS.21
(f) "WIDELY DISTRIBUTED MEDIA" MEANS CONTENT THAT IS MADE22
AVAILABLE TO A LARGE, GENERAL AUDIENCE THROUGH CHANNELS THAT23
ALLOW BROAD ACCESS AND REGULAR DISSEMINATION , AS OPPOSED TO24
PRIVATE, NICHE, OR RESTRICTED COMMUNICATIONS.25
(2) I N CONNECTION WITH A CRIMINAL , CIVIL , OR OTHER26
INVESTIGATORY OR ENFORCEMENT ACTIVITY:27
HB26-1037-5-
(a) A LAW ENFORCEMENT ENTITY SHALL NOT OBTAIN OR RECEIVE1
ACCESS TO AN INDIVIDUAL 'S PERSONAL DATA FROM A THIRD PARTY IN2
EXCHANGE FOR ANYTHING OF VALUE;3
(b) A LAW ENFORCEMENT ENTITY SHALL NOT REQUEST, OBTAIN, OR4
RECEIVE ACCESS TO AN INDIVIDUAL'S PERSONAL DATA FROM A FEDERAL,5
STATE, OR LOCAL LAW ENFORCEMENT OR OTHER GOVERNMENT AGENCY OR6
DEPARTMENT IF THE DATA WAS OBTAINED FROM A THIRD PARTY IN7
EXCHANGE FOR ANYTHING OF VALUE;8
(c) A LAW ENFORCEMENT ENTITY SHALL NOT SHARE ON A9
THIRD-PARTY PLATFORM OR SELL, IN EXCHANGE FOR ANYTHING OF VALUE,10
AN INDIVIDUAL'S PERSONAL DATA TO A FEDERAL, STATE, OR LOCAL LAW11
ENFORCEMENT OR OTHER GOVERNMENT AGENCY OR DEPARTMENT, OR A12
THIRD PARTY IF THE PERSONAL DATA WAS DIRECTLY OR INDIRECTLY13
COLLECTED BY THE LAW ENFORCEMENT AGENCY; AND14
(d) A GOVERNMENT ENTITY , INCLUDING A LAW ENFORCEMENT15
ENTITY, SHALL NOT PROVIDE OR SHARE WITH A FEDERAL, STATE, OR LOCAL16
LAW ENFORCEMENT AGENCY OR DEPARTMENT AN INDIVIDUAL'S PERSONAL17
DATA OBTAINED FROM A THIRD PARTY IN EXCHANGE FOR ANYTHING OF18
VALUE.19
(3) SUBSECTION (2) OF THIS SECTION DOES NOT APPLY WHEN:20
(a) A LAW ENFORCEMENT ENTITY HAS OBTAINED A VALID JUDICIAL21
WARRANT, SUBPOENA , OR COURT ORDER , AND ANY ACCOMPANYING22
AFFIDAVIT TO EACH PARTY , PURSUANT TO RULE 16 OF THE COLORADO23
RULES OF CRIMINAL PROCEDURE , OR ANY SUCCESSOR RULE , FOR THE24
PERSONAL DATA OF THE SPECIFICALLY IDENTIFIED INDIVIDUAL;25
(b) THE LAW ENFORCEMENT ENTITY ASSERTS IN GOOD FAITH THAT26
AN EMERGENCY SITUATION EXISTS THAT INVOLVES THE RISK OF DEATH OR27
HB26-1037-6-
SERIOUS BODILY INJURY TO A PERSON THAT REQUIRES IMMEDIATE1
DISCLOSURE;2
(c) THE PERSONAL DATA IS LAWFULLY AVAILABLE TO THE PUBLIC3
THROUGH GOVERNMENT RECORDS OR WIDELY DISTRIBUTED MEDIA;4
(d) THE PERSONAL DATA PERTAINS TO A SPECIFIC INDIVIDUAL, WAS5
VOLUNTARILY MADE AVAILABLE TO THE PUBLIC BY THE SPECIFIC6
INDIVIDUAL, AND WAS OBTAINED IN COMPLIANCE WITH ALL APPLICABLE7
LAWS, REGULATIONS , CONTRACTS , PRIVACY POLICIES , AND TERMS OF8
SERVICE;9
(e) T HE SPECIFIC INDIVIDUAL TO WHOM THE PERSONAL DATA10
PERTAINS INTENDED LAW ENFORCEMENT TO BE A RECIPIENT OF THE11
PERSONAL DATA , AS EVIDENCED BY CASE -SPECIFIC, EXPRESS CONSENT12
FROM THE SPECIFIC INDIVIDUAL;13
(f) T HE THIRD PARTY PROVIDING THE PERSONAL DATA WAS14
AUTHORIZED BY THE SPECIFIC INDIVIDUAL TO WHOM THE PERSONAL DATA15
PERTAINS TO PROVIDE THE DATA TO THE LAW ENFORCEMENT ENTITY, AS16
EVIDENCED BY CASE -SPECIFIC, EXPRESS CONSENT FROM THE SPECIFIC17
INDIVIDUAL; OR18
(g) THE PERSONAL DATA IS PROVIDED TO OR BY THE NATIONAL19
CENTER FOR MISSING AND EXPLOITED CHILDREN OR ITS SUCCESSOR ENTITY20
AND IS RELATED TO AN INVESTIGATION INVOLVING A MISSING OR21
EXPLOITED CHILD.22
(4) S UBSECTIONS (3)(d) TO (3)(f) OF THIS SECTION DO NOT23
VIOLATE SUBSECTION (2) OF THIS SECTION IF THE PERSON MADE THEIR24
PERSONAL DATA PUBLICLY AVAILABLE , EVEN IF A LAW ENFORCEMENT25
ENTITY PURCHASES THE PERSONAL DATA FROM A THIRD PARTY.26
(5) (a) A VIOLATION OF THIS SECTION CONSTITUTES AN INJURY ,27
HB26-1037-7-
AND A PERSON WHO IS INJURED MAY BRING A LEGAL ACTION FOR1
INJUNCTIVE RELIEF , DECLARATORY RELIEF , OR OTHER RELIEF DEEMED2
NECESSARY TO ENFORCE THIS SECTION IN A COURT OF COMPETENT3
JURISDICTION. A PLAINTIFF MAY SEEK REASONABLE ATTORNEY FEES4
PURSUANT TO THIS SECTION.5
(b) (I) A COURT SHALL NOT ADMIT PERSONAL DATA ACQUIRED IN6
VIOLATION OF THIS SECTION OR EVIDENCE DERIVED FROM THAT7
INFORMATION AT A TRIAL, HEARING, OR OTHER PROCEEDING UNLESS THE8
PARTY SEEKING TO INTRODUCE THE EVIDENCE PROVIDES A COPY OF THE9
VALID JUDICIAL WARRANT , SUBPOENA , OR COURT ORDER AND ANY10
ACCOMPANYING AFFIDAVIT TO EACH PARTY PURSUANT TO RULE 16 OF THE11
COLORADO RULES OF CRIMINAL PROCEDURE, OR ANY SUCCESSOR RULE.12
(II) A COURT MAY WAIVE THE REQUIREMENT IN SUBSECTION13
(5)(b)(I) OF THIS SECTION IF THE COURT FINDS THAT IT WAS NOT POSSIBLE14
TO PROVIDE A PARTY WITH THE VALID JUDICIAL WARRANT, SUBPOENA, OR15
COURT ORDER AND ANY ACCOMPANYING APPLICATION WITHIN THE TIME16
REQUIRED BY RULE 16 OF THE COLORADO RULES OF CRIMINAL PROCEDURE,17
OR ANY SUCCESSOR RULE, AND THE COURT FINDS THAT THE PARTY WILL18
NOT BE PREJUDICED BY THE DELAY IN RECEIVING THE INFORMATION.19
SECTION 4. In Colorado Revised Statutes, 16-3-303.5, add (9)20
as follows:21
16-3-303.5. Location information - search warrant required22
- definitions.23
(9) NOTHING IN THIS SECTION AUTHORIZES A GOVERNMENT ENTITY24
TO OBTAIN LOCATION INFORMATION OF AN ELECTRONIC DEVICE IN25
EXCHANGE FOR ANYTHING OF VALUE IN VIOLATION OF SECTION26
16-3-303.3.27
HB26-1037-8-
SECTION 5. Safety clause. The general assembly finds,1
determines, and declares that this act is necessary for the immediate2
preservation of the public peace, health, or safety or for appropriations for3
the support and maintenance of the departments of the state and state4
institutions.5
HB26-1037-9-