EnglishEspañol
AI Meeting Recording LawsColorado Laws flagColorado Laws
Colorado flag

Colorado

Colorado AI Meeting Recording Laws (2026)

Independently fact-checkedEditor-reviewedLaw current as of November 1, 2026By Recording Law Editorial TeamReviewed November 2, 202615 min read

Independently fact-checked against primary sources (last audited November 1, 2026). · Reviewed by the RecordingLaw editorial team. · Law checked current as of November 1, 2026. · 2 primary sources cited on this page. How we verify our legal content

Colorado AI Meeting Recording Laws (2026)

Colorado is a one-party consent state, so a meeting participant who activates an AI recording tool generally records lawfully under C.R.S. 18-9-303 without notifying anyone else on the call. That consent does not help a non-party, such as the tool's vendor, that records for the purpose of committing an unlawful act (18-9-303(1)(b)). Federal law withholds one-party consent's protection for a recording made for a criminal or tortious purpose (18 U.S.C. 2511(2)(d)), and in August 2026 a federal court let a Wiretap Act claim against Otter.ai proceed on the theory that the vendor's use of meetings to train its own AI could be such a purpose. The Colorado Privacy Act and, from January 1, 2027, the state's new Automated Decision-Making Technology Act add separate data-handling obligations that go beyond the consent question.

Colorado uses a dual-statute framework to regulate recording. Telephone wiretapping falls under Colo. Rev. Stat. § 18-9-303, while in-person eavesdropping is governed by § 18-9-304. Both statutes follow one-party consent, meaning one participant in a conversation may record without the knowledge of the others. But Colorado's treatment of AI meeting tools is more complex than many one-party consent states, because the state has enacted some of the nation's most significant AI-specific legislation.

The Colorado Privacy Act (CPA) creates an additional compliance layer that affects how AI recording tools collect, process, and store meeting data, and from January 1, 2027 the Automated Decision-Making Technology (ADMT) Act enacted by SB 26-189 adds notice duties in a narrower set of situations. The Colorado Artificial Intelligence Act (SB 24-205) is still sometimes described as Colorado's AI law, but it never became enforceable, and SB 26-189 replaces it on January 1, 2027. Understanding Colorado's recording laws requires looking beyond the wiretapping statutes alone.

Telephone Wiretapping: § 18-9-303

Colo. Rev. Stat. § 18-9-303 prohibits wiretapping telephone, telegraph, or electronic communications without the consent of at least one party to the conversation. The statute covers the interception of any communication transmitted via wire or electronic means.

Under § 18-9-303, it is a criminal offense to "knowingly overhear, read, take, copy, or record" a "telephone, telegraph, or electronic communication" without the consent of a party to the communication. The law also prohibits aiding, authorizing, or permitting another person to wiretap.

This statute applies directly to AI meeting recording tools that capture audio from phone calls, VoIP conversations, and virtual meetings conducted over electronic communication platforms.

In-Person Eavesdropping: § 18-9-304

Colo. Rev. Stat. § 18-9-304 separately prohibits eavesdropping on conversations. A person "not visibly present during a conversation or discussion commits eavesdropping" if they "knowingly overhear[] or record[] such conversation or discussion without the consent of at least one of the principal parties thereto."

The key distinction from § 18-9-303 is that eavesdropping under § 18-9-304 turns on the listener not being visibly present in the conversation, not on whether the conversation happened in a private place. For virtual meetings, the participant who activates an AI recording tool is a party to (and visibly present in) the conversation, so courts would likely apply § 18-9-303 (the telephone/electronic wiretapping statute) rather than the in-person eavesdropping provision.

Colorado's one-party consent rule means that any participant in a conversation may legally record it without notifying the other parties. This applies to phone calls, virtual meetings, and in-person discussions (§ 18-9-304's eavesdropping offense reaches only someone not visibly present in the conversation, not a participant who is openly there). The consenting party must be an actual participant in the communication, not a third party who has merely gained access.

Interaction with Federal Law

Federal wiretapping law under 18 U.S.C. § 2511 also lets one party consent, but not when a recording is made "for the purpose of committing any criminal or tortious act" (18 U.S.C. § 2511(2)(d)). For interstate calls, no single rule decides which state's law governs, and a participant in an all-party consent state can expose the recording to that state's law. Colorado users recording calls with California, Florida, or Illinois participants should consider obtaining consent from all parties.

Close-up of a laptop with a small glowing microphone-style indicator light on a dark screen, no text

How Colorado Law Applies to AI Meeting Recorders

When a Colorado-based meeting participant activates an AI recording tool like Otter.ai, Fireflies.ai, or Zoom AI Companion, that participant provides the one-party consent required under § 18-9-303. The participant is a party to the communication, and they have consented to the recording. The statute does not require the consenting party to personally operate the recording equipment; it requires only that a party to the communication has consented.

In Colorado an AI note-taker a participant turns on generally satisfies one-party consent, but calendar auto-joins and callers in all-party consent states call for telling everyone.
A participant's consent usually covers an AI note-taker in Colorado. Auto-join tools and out-of-state callers are where consent gets shaky.

This means the human user's activation of the AI tool generally satisfies Colorado's wiretapping statute for virtual meetings, with one limit: 18-9-303(1)(b) makes it an offense for a non-party, such as a vendor's bot, to record for the purpose of committing an unlawful act, whatever the consent. Federal law has a similar limit (18 U.S.C. 2511(2)(d)), and in In re Otter.AI Privacy Litigation (August 2026) a federal court held, at the pleading stage, that a vendor's alleged use of meetings to train its own AI could be a tortious purpose.

Colorado's statutes do not define "party" in a way that includes or excludes AI systems. AI meeting bots that appear as named participants in a meeting (such as "Fireflies.ai Notetaker") raise the question of whether they are parties, tools of a party, or unauthorized third parties.

Under prevailing legal analysis, the AI bot functions as a tool or agent of the consenting participant. The bot does not independently participate in the conversation; it records and processes audio on behalf of the human user who authorized it. As long as a human participant consented to the recording, Colorado's one-party consent requirement is generally met. Consent does not cover a recording made for the purpose of committing an unlawful act (C.R.S. 18-9-303(1)(b) and 18-9-304(1)(b)), and no Colorado court appears to have ruled on the bot question or on whether a vendor's own use of recordings could fall within that limit.

The most legally problematic scenario involves AI tools that auto-join meetings from calendar data without explicit per-meeting authorization. If a tool scrapes a user's calendar and joins a meeting autonomously, the question is whether the user's general authorization of the tool constitutes "consent" for each individual recording.

A conservative reading of Colorado law suggests that consent should be specific to each communication. Blanket authorization via account settings or calendar integration may not satisfy the statute if the user is not aware that a specific meeting is being recorded. In re Otter.AI Privacy Litigation (N.D. Cal., No. 5:25-cv-06911, formerly Brewer v. Otter.ai) involves similar auto-join allegations. In August 2026 the court let the core federal Wiretap Act, California privacy and Illinois biometric claims against Otter.ai proceed past a motion to dismiss; the case is now in discovery, and no court has decided whether Otter actually violated the law. Because the surviving federal claim applies nationwide, the case is relevant to recordings made in Colorado.

Colorado's AI-Specific Legislation

Colorado AI Act (SB 24-205) and Its Replacement (SB 26-189)

Colorado enacted SB 24-205 on May 17, 2024, as comprehensive AI consumer protection legislation. The law's effective date was delayed from February 1, 2026, to June 30, 2026, during a special legislative session in August 2025. In April 2026, a federal court order in X.AI LLC v. Weiser (D. Colo.) barred the attorney general from enforcing it, or any replacement enacted that session, until after the court rules on a preliminary-injunction motion. Governor Polis signed SB 26-189 on May 14, 2026, repealing and reenacting SB 24-205 as a narrower Automated Decision-Making Technology (ADMT) Act. The repeal and reenactment takes effect January 1, 2027, so the 2024 law has never been enforceable in practice even though its June 30, 2026 start date has passed.

As originally enacted, SB 24-205 would have regulated "high-risk AI systems," defined as systems that make or are a substantial factor in making consequential decisions with material legal or similarly significant effects on consumers, and would have imposed risk-management programs, annual impact assessments, and algorithmic-discrimination duties on developers and deployers. That framework has never been enforced, and SB 26-189 replaces it on January 1, 2027. SB 26-189 substitutes a narrower disclosure-and-notice model; while AI meeting recording tools are not the primary target of either version, the current ADMT Act may still create notice obligations for how these tools process and use recorded data in covered decisions.

What the enacted ADMT Act actually requires, beginning January 1, 2027:

  • Point-of-interaction notice: Before using a covered automated decision-making technology to materially influence a consequential decision, a deployer must give the consumer clear and conspicuous notice that it used or will use that technology, plus instructions for obtaining further information (C.R.S. 6-1-1704(1))
  • Post-adverse-outcome disclosure: If a covered ADMT materially influences a decision that produces an adverse outcome, the deployer has 30 days to provide a plain-language description of the decision and the technology's role in it, a simple process for requesting details about the system and the data it used, and an explanation of the consumer's rights (6-1-1704(3))
  • Correction and human review: A consumer who experiences an adverse outcome may request correction of factually incorrect or materially inaccurate personal data, and an opportunity for meaningful human review and reconsideration of the decision, to the extent commercially reasonable (6-1-1705(1))
  • Record keeping: Deployers must retain records reasonably necessary to demonstrate compliance for at least three years after a consequential decision (6-1-1703)

These duties attach only where a covered ADMT materially influences a consequential decision. Recording and transcribing a meeting does not by itself trigger them. But if a tool's AI analysis of recorded meetings is used that way, for example to drive an employment or promotion decision, the deployer's obligations under the ADMT Act would apply from January 1, 2027.

Colorado Privacy Act (CPA)

The Colorado Privacy Act, effective July 1, 2023, grants consumers rights over their personal data and imposes obligations on businesses that collect it. The CPA gives Colorado residents the right to access, correct, delete, and opt out of the sale of their personal data, as well as opt out of targeted advertising and certain forms of profiling.

The CPA protects Colorado residents acting in a personal or household capacity and applies only to businesses that process the data of at least 100,000 Colorado consumers a year (or 25,000 if they profit from selling data) (C.R.S. 6-1-1304(1)). It does not cover employees or job applicants acting in an employment context (C.R.S. 6-1-1303(6)(b)), so it adds little to an employer's internal meetings. It matters more for AI tool providers and for businesses recording meetings with consumers, where covered businesses must provide clear privacy notices, honor opt-out requests, and limit data collection to what is reasonably necessary.

One part reaches further. Since July 1, 2025, any business that collects biometric identifiers, such as voiceprints, must follow the CPA's biometric rules regardless of size, including for employees (C.R.S. 6-1-1314).

Under C.R.S. 6-1-1311(1)(a), the Colorado Attorney General and district attorneys have exclusive authority to enforce the CPA. There is no private right of action, and for purposes of enforcement a violation of the CPA is a deceptive trade practice under Colorado's Consumer Protection Act.

Empty corporate boardroom with leather chairs around a long table, a dark blank wall screen at the end

ToolHow It RecordsColorado Compliance Notes
Otter.aiBot joins meeting as participantOne-party consent generally satisfied by participant activation, subject to the unlawful-purpose limit below; CPA obligations may apply to consumer data and voiceprints
Fireflies.aiBot joins meeting; calendar integrationSame one-party consent framework and unlawful-purpose limit; auto-join requires participant awareness
Zoom AI CompanionBuilt into Zoom platformHost activation generally provides consent; notification banner displayed to all participants
Microsoft CopilotIntegrated into TeamsActivated by participant; Teams recording indicator provides notice
Google Gemini in MeetNative to Google MeetParticipant activation generally satisfies consent; meeting notification shown
FathomAI notetaker used by the meeting host; check the vendor's documentation for how it captures audioHost is a party, so Colorado's one-party rule is generally met, subject to the unlawful-purpose limit below; review the vendor's data use policies

Under Colorado's recording statutes, a tool activated by a meeting participant generally has the consent the statute requires. Consent does not cover a recording made for the purpose of committing an unlawful act (C.R.S. 18-9-303(1)(b)), and no Colorado court has ruled on whether a vendor's own use of recordings could fall within that limit. Under the similar federal limit (18 U.S.C. 2511(2)(d)), the Wiretap Act claim against Otter.ai survived a motion to dismiss in August 2026 on that theory. The additional compliance layer today comes from the CPA, which governs how covered businesses collect, store, process, and use consumer data and voiceprints after recording. From January 1, 2027, the narrower ADMT Act under SB 26-189 adds notice and disclosure duties, but only where a covered automated decision-making technology materially influences a consequential decision.

Penalties for Violations

Criminal Penalties

Colorado's dual-statute structure creates different penalty levels for telephone wiretapping and in-person eavesdropping.

ViolationStatuteClassificationJail/PrisonFine
Telephone/electronic wiretapping§ 18-9-303Class 2 misdemeanorUp to 120 daysUp to $750
In-person eavesdropping§ 18-9-304Class 2 misdemeanorUp to 120 daysUp to $750
Using illegally obtained info§ 18-9-303(1)(c)Class 2 misdemeanorUp to 120 daysUp to $750

Colorado wiretapping was previously a Class 6 felony, but House Bill 23-1293 downgraded it to a Class 2 misdemeanor effective October 1, 2023, aligning it with the penalty for in-person eavesdropping. Using or disclosing information obtained through illegal wiretapping, where the person knows or has reason to know the information was illegally obtained, falls under the same statute and is also a Class 2 misdemeanor.

Civil Remedies

Colorado does not have a dedicated state statute creating civil damages for a private unlawful recording. Colo. Rev. Stat. § 13-21-128 addresses a different situation: it lets a person whose recording was destroyed or unlawfully seized by a law enforcement officer file an affidavit with the officer's employing agency, which can lead to a $500 statutory recovery for the recording plus actual damages, and punitive damages of up to $15,000 if the agency denies the claim in bad faith. It does not apply to recordings made by a private individual.

For an unlawful interception, the main civil remedy is federal: the Wiretap Act, 18 U.S.C. § 2520, lets an aggrieved person sue, and a court may award actual damages or statutory damages of whichever is greater, $100 per day of violation or $10,000, plus punitive damages in appropriate cases and reasonable attorney's fees. A recording made with one participant's consent, including by an AI meeting tool a participant activates, generally does not violate the federal Act, unless it is made for a criminal or tortious purpose (18 U.S.C. 2511(2)(d)). In In re Otter.AI Privacy Litigation, the federal claim against the AI vendor survived a motion to dismiss in August 2026 on that theory.

A printed map of the United States pinned to a cork board with colored pins in various states, no readable labels

Colorado AI Act Enforcement

A violation of Colorado's AI law (the ADMT Act under SB 26-189, effective January 1, 2027) is a deceptive trade practice under the Colorado Consumer Protection Act, and the Act's disclosure and consumer-rights requirements are enforceable exclusively by the Colorado Attorney General (C.R.S. 6-1-1706). The enacted Act contains no affirmative defense or safe harbor for companies that follow a published AI risk management framework.

Employer and Workplace Considerations

Recording Policies for Colorado Employers

Colorado employers may generally use AI meeting recording tools under the one-party consent framework, provided a meeting participant activates the tool, subject to the unlawful-purpose limits described above. Best practices include establishing written recording policies, notifying employees about the use of AI tools (even though not legally required under the wiretapping statute), and addressing cross-state considerations for remote workers.

Colorado's AI law (the ADMT Act under SB 26-189, effective January 1, 2027) adds a layer of obligation for employers using AI tools in employment decisions. If AI-generated meeting transcripts or analyses are used to evaluate employee performance, make promotion decisions, or inform disciplinary actions, the employer may need to comply with the Act's consumer-notice and disclosure requirements.

CPA Data Minimization

The Colorado Privacy Act's data-minimization duties protect consumers, not employees or job applicants acting in an employment context (C.R.S. 6-1-1303(6)(b)). They matter mainly to AI tool providers and to businesses that record meetings with customers or other consumers: a covered business should collect only the personal data reasonably necessary for the stated purpose, and retaining recordings indefinitely or using them for unrelated purposes may violate the CPA. For an employer's internal meetings, the CPA provision that does apply is its biometric section (C.R.S. 6-1-1314), which covers a tool that creates employee voiceprints.

HIPAA in Colorado Healthcare Settings

Healthcare organizations in Colorado must comply with HIPAA when AI meeting tools capture protected health information. This requires a Business Associate Agreement with the tool provider, encryption of data in transit and at rest, and assurance that recorded PHI is not used for AI model training without proper de-identification.

Colorado's strong healthcare sector, including major hospital systems and research institutions along the Front Range, makes HIPAA compliance a significant consideration for any workplace AI recording deployment.

Multi-State Workforce Considerations

Colorado employers with remote workers in all-party consent states (California, Florida, Illinois, and others) should obtain consent from all participants when those workers join recorded meetings. No single rule decides which state's law governs a multi-state call, and Colorado's one-party consent rule does not override the recording laws of other states where participants are located.

A laptop screen showing a single glowing padlock-shield glyph icon on a dark background, no text, minimal desk

Cross-State Considerations

Colorado's one-party consent framework applies to communications originating in Colorado. For cross-state communications, no single rule decides which state's law governs. In Kearney v. Salomon Smith Barney (2006), the California Supreme Court applied California law going forward to calls a Georgia-based firm recorded with California clients, while Georgia law governed damages for the past recordings, so an AI recording activated by a Colorado participant on a call with a California participant may need to comply with California's all-party consent requirements.

Some courts have applied the law of the state where the recording party is located, which would favor Colorado's less restrictive rule. Others have applied the law of the recorded party's state, which could require all-party consent. The uncertainty in this area makes it prudent for Colorado-based users to disclose AI recording when participants from all-party consent states are on the call.

This article provides general legal information about Colorado recording laws as they apply to AI meeting tools. Laws and their interpretations can change; Colorado's AI law (the ADMT Act under SB 26-189) is scheduled to take effect January 1, 2027. Consult an attorney for advice specific to your situation.

More Colorado Laws

Frequently Asked Questions

Can I legally use AI meeting recorders like Otter.ai in Colorado?

Yes, under Colorado's one-party consent framework (Colo. Rev. Stat. § 18-9-303), you may record a meeting if you are a participant and you activate the AI tool. The recording is generally lawful under Colorado law without notifying other participants. Colorado separately bars a non-party, such as a tool's vendor, from recording for the purpose of committing an unlawful act (C.R.S. 18-9-303(1)(b)), and federal law withholds one-party consent's protection for a criminal or tortious purpose (18 U.S.C. 2511(2)(d)); in August 2026 a federal court let a Wiretap Act claim against Otter.ai proceed on the theory that the vendor's use of meetings to train its AI could be such a purpose. However, if participants are located in all-party consent states, you may need their consent under those states' laws.

What is the difference between Colorado's wiretapping and eavesdropping statutes?

Colorado has separate statutes for telephone/electronic wiretapping (§ 18-9-303) and in-person eavesdropping (§ 18-9-304). Both require one-party consent, and since House Bill 23-1293 took effect on October 1, 2023, both carry the same penalty: telephone wiretapping and in-person eavesdropping are each a Class 2 misdemeanor, punishable by up to 120 days in jail and a fine of up to $750. Virtual meetings generally fall under the wiretapping statute.

How does the Colorado AI Act affect AI meeting recording tools?

The original Colorado AI Act (SB 24-205) never became enforceable: its start date was pushed to June 30, 2026, and an April 2026 federal court order barred the attorney general from enforcing it. Its replacement, SB 26-189 (the Automated Decision-Making Technology Act), takes effect January 1, 2027, and primarily targets automated decision-making technology used in consequential decisions. AI meeting tools are not the primary focus, but if recorded data is used for employment decisions, performance evaluations, or other consequential purposes, the Act's consumer-notice and disclosure requirements may apply. The Colorado Attorney General has exclusive enforcement authority.

Can my employer use AI to record workplace meetings in Colorado?

If a meeting participant (such as a manager or host) activates the AI tool, the one-party consent requirement is generally satisfied under Colorado law, unless the recording is made for the purpose of committing an unlawful act (C.R.S. 18-9-303(1)(b)) or, under federal law, a criminal or tortious purpose (18 U.S.C. 2511(2)(d)). The Colorado Privacy Act generally does not cover employees acting in an employment context, although its biometric rules (C.R.S. 6-1-1314) apply if a tool creates employee voiceprints. Colorado's AI law (the ADMT Act under SB 26-189, effective January 1, 2027) imposes additional notice obligations if AI-generated meeting data is used in consequential employment decisions.

What civil damages can I recover if someone illegally records me in Colorado?

Colorado does not have a dedicated state civil-damages statute for a private unlawful recording; Colo. Rev. Stat. § 13-21-128 is a narrower law covering recordings destroyed or seized by a law enforcement officer. If a recording was intercepted without any party's consent, or with a party's consent but for a criminal or tortious purpose (18 U.S.C. 2511(2)(d)), the main civil remedy is the federal Wiretap Act, 18 U.S.C. § 2520, under which a court may award actual damages or statutory damages of the greater of $100 a day or $10,000, plus punitive damages and attorney's fees. In August 2026 a federal court let such a claim proceed against Otter.ai on the theory that using meetings to train its own AI could be a tortious purpose.

Updates

We corrected the description of Kearney v. Salomon Smith Barney (California law applied only going forward; Georgia law governed past damages) and replaced an unsourced description of how Fathom records with neutral wording.

We corrected how this page describes Colorado's 2024 AI Act (it never became enforceable, rather than being repealed before taking effect), narrowed the Colorado Privacy Act's reach to consumer data and voiceprints because it excludes employees, fixed the federal damages figure, removed an unsupported 'most restrictive law governs' rule, added the unlawful-purpose limit on consent, and updated the Otter.ai case to its August 2026 ruling. We added that Colorado's consent rule does not protect a non-party, such as an AI vendor, that records for an unlawful purpose, that federal law withholds one-party consent's protection for a criminal or tortious purpose (a theory on which the federal claim against Otter.ai survived dismissal in August 2026), and that federal Wiretap Act damages are discretionary.

Independently fact-checked against the cited primary sources; governing law re-checked for recent changes

Corrected the Colorado Privacy Act enforcement statement to name district attorneys alongside the attorney general as C.R.S. 6-1-1311(1)(a) requires, removed a claim that companies following NIST or ISO risk management frameworks may assert an affirmative defense (no such safe harbor appears anywhere in the enacted SB 26-189), replaced a list of obligations carried over from the repealed SB 24-205 with the notice, disclosure, correction and record-keeping duties the ADMT Act actually imposes from January 1, 2027, and dropped a stale as-of date from the statement that no Colorado court has ruled on AI meeting bots.

Corrected a citation error: Colo. Rev. Stat. § 13-21-128 does not create a $10,000 civil-damages remedy for private unlawful recording (it governs law-enforcement seizure or destruction of recordings). Colorado has no dedicated state civil-damages statute for private interception; the page now points readers to the applicable remedy, the federal Wiretap Act's civil action under 18 U.S.C. § 2520.

Independently fact-checked against the cited primary sources; governing law re-checked for recent changes

Corrected: the original Colorado AI Act (SB 24-205) was repealed and reenacted by SB 26-189 (signed May 14, 2026) as a narrower Automated Decision-Making Technology Act, now effective January 1, 2027, not June 30, 2026.

Governing law re-checked for recent changes

Corrected the description of Colorado's eavesdropping statute (Colo. Rev. Stat. § 18-9-304): it turns on whether the listener was visibly present during the conversation, not on a "private place" requirement that does not appear in the statute's text; also restored "electronic" to the quoted list of covered communications under § 18-9-303.

Governing law re-checked for recent changes

Corrected a factual error: telephone/electronic wiretapping under Colo. Rev. Stat. § 18-9-303 was listed as a Class 6 felony (12 to 18 months, $1,000 to $100,000 fine), but House Bill 23-1293 downgraded it to a Class 2 misdemeanor (up to 120 days, up to $750 fine) effective October 1, 2023, aligning it with the in-person eavesdropping penalty under § 18-9-304. Removed a fabricated "cordless phone wiretapping / § 18-9-303(4)" table row; the current statute has no such subsection since the felony/cordless-phone distinction was eliminated by the same 2023 amendment. Updated the KeyTakeaways, penalty table, penalty-section prose, and FAQ answer to reflect the correct current classification and cite HB 23-1293.

Reviewed and approved by an editor

Sources and References

  1. Colo. Rev. Stat. § 18-9-303 - Wiretapping Prohibited(law.justia.com)
  2. Colo. Rev. Stat. § 18-9-304 - Eavesdropping Prohibited(law.justia.com)
  3. Colorado AI Act (SB 24-205)(leg.colorado.gov).gov
  4. Colorado Privacy Act - AG Office(coag.gov).gov
  5. In re Otter.AI Privacy Litigation, N.D. Cal., No. 5:25-cv-06911 (docket; formerly Brewer v. Otter.ai)(courtlistener.com)
  6. Colorado AI Act Deep Dive - National Association of Attorneys General(naag.org)
  7. 18 U.S.C. § 2520 - Recovery of Civil Damages Authorized (federal Wiretap Act civil remedy)(law.cornell.edu)
  8. 18 U.S.C. § 2511 - Federal Wiretap Act(law.cornell.edu)
  9. Colorado SB 21-190 (enrolled act creating the Colorado Privacy Act), C.R.S. 6-1-1311 enforcement(content.leg.colorado.gov)
  10. Colorado SB 26-189 (enrolled act), Automated Decision-Making Technology in Consequential Decisions, C.R.S. 6-1-1701 to 6-1-1709(leg.colorado.gov)
  11. Colorado SB 26-189 bill history and status (Governor signed May 14, 2026)(leg.colorado.gov)
Share: