Careers

Diversity, Equity & Inclusion

Experience

Innovation

Interactive Maps

Locations

About

Pages

Meet our team of innovators
Ask us how we do it

Professionals

Insights

Services

Thompson Hine LLP, a full-service business law firm with approximately 400 lawyers in 8 offices, was ranked number 1 in the category “Most innovative North American law firms: New working models” by The Financial Times and was 1 of 7 firms shortlisted for The American Lawyer’s inaugural Legal Services Innovation Award. The firm has been recognized by the National Law Journal as a Legal Technology Trailblazer and featured by Bloomberg for its innovative service delivery models, which drive accuracy and predictability. The firm’s commitment to innovation is embodied in Thompson Hine SmartPaTHTM – a smarter way to work – predictable, efficient and aligned with client goals. For more information, please visit ThompsonHine.com and ThompsonHine.com/SmartPaTH.

Home | Thompson Hine LLP

Atlanta

Chicago

Cincinnati

Cleveland

Columbus

Dayton

Los Angeles

New York

Washington, D.C.

In May 2024, Colorado Governor Jared Polis signed into law <a href="https://leg.colorado.gov/sites/default/files/2024a_041_signed.pdf">Senate Bill 41</a>, which amends the Colorado Privacy Act (CPA) to create new requirements specifically targeting minors’ use of online services and products. Importantly, the law establishes a duty of care to avoid any heightened risk of harm to minors online and regulates the use of online targeted behavior advertising impacting individuals under the age of 18. Unlike the CPA, SB 41 does not have revenue or processing thresholds and, therefore, its requirements apply to more businesses. The amendments take effect on October 1, 2025.

core/paragraph

core/heading

For purposes of SB 41, the following key terms apply:

“Minor” means any consumer who is under 18 years of age. This is important as many data protection laws, including the <a>Children’s Online Privacy Protection Act of 1998 (COPPA</a>), define a minor as a child under the age of 13.

“Online service, product, or feature" means any service, product, or feature provided online. It does not include telecommunications service, broadband internet access service, or the delivery or use of a physical product.

“Precise geolocation data” means information derived from technology that identifies the specific location of an individual within a radius of 1,750 feet. Unique to Colorado, any service or application used by, or under the direction of, a ski area operator is not subject to restrictions on geolocation data.

Under SB 41, any business offering an online service, product, or feature to a consumer whom the controller actually knows or willfully disregards as being a minor has a duty to use reasonable care to avoid any heightened risk of harm to minors caused by the online service, product, or feature. An online service, product or feature does not include telecommunication services.

SB 41 defines heightened risk of harm as processing the personal data of minors in a manner that presents a reasonably foreseeable risk that could cause:

core/list

Without a minor’s consent (or the consent of the appropriate parent or guardian), SB 41 prohibits processing a minor’s personal data for:

Controllers are prohibited from using system design features to significantly increase, sustain, or extend a minor's online service, product, or feature use.

Controllers cannot offer any direct messaging platform for use by a minor without providing readily accessible and easy-to-use safeguards to limit the ability of an adult to send unsolicited communications to the minor. This provision does not apply to e-mail, direct messaging not posted publicly, or any service provided at the direction of an educational entity.

The collection of precise geolocation data of minors is prohibited without a minor’s consent (or in the case of a child, the consent of the parent or guardian) and:

i.   precise geolocation data is reasonably necessary for the controller to provide the online service, product, or feature,

ii.  the controller only collects and retains the precise geolocation data for the time necessary to provide the online service, product, or feature, and

iii. the controller provides a signal to the minor indicating that the controller is collecting precise geolocation data and that the signal is available to the minor for the entire duration of the collection.

Complying with verifiable parental consent requirements as laid out in COPPA sufficiently satisfies the parental consent requirements under SB 41.

The new law does not require controllers or processors to implement age verification or gating systems, and controllers that conduct commercially reasonable age estimations are not liable for errors in those estimations.

SB 41 mimics and references several existing obligations of processors and controllers but is tailored toward the data of minors. A processor must adhere to the instructions of a controller and assist the controller in meeting the controller's obligations. This includes entering a sufficient contract with the controller, having appropriate technical and organizational measures to protect the data of a minor, and providing necessary information for the controller to conduct a data processing assessment of a minor’s personal data.

Data processing assessments are also reiterated in SB 41, requiring such an assessment to outline the categories of a minor’s personal data, the purposes for processing the minor’s personal data, and the foreseeable heightened risk of harm to the minor.

<em>This advisory bulletin may be reproduced, in whole or in part, with the prior permission of Thompson Hine LLP and acknowledgment of its source and copyright. This publication is intended to inform clients about legal matters of current interest. It is not intended as legal advice. Readers should not act upon the information contained in it without professional counsel.</em>

https://admin.thompsonhine.com/wp-content/uploads/2024/06/Colorado-Adds-Protections-for-Minors-to-Privacy-Law.pdf

Colorado Adds Protections for Minors to Privacy Law

Services