Colorado
Colorado Employee Monitoring Laws: Notice Rules Explained (2026)
Colorado employers face two different 2026 rules that get confused online: a narrow social media privacy law, C.R.S. § 8-2-127, and SB 26-189, an AI hiring-decision disclosure law that is not a general electronic-monitoring notice statute despite frequent claims otherwise.
Information last verified on July 9, 2026. This article has not yet been reviewed by a licensed lawyer.
This article covers what Colorado law actually says about an employer's ability to monitor its employees, separate from the general rules on recording conversations covered in Colorado Recording Laws. It pays particular attention to a common online error: Colorado is frequently listed alongside Connecticut, Delaware, New York, and Maine as a state with a general electronic-monitoring notice law. That is not accurate. Colorado's 2026 law, SB 26-189, is an AI hiring-transparency statute, and this article explains exactly what it does and does not require.
Jurisdiction scope: This article addresses Colorado state law on employer monitoring of employees, including SB 26-189 (automated decision-making technology in employment decisions), C.R.S. § 8-2-127 (social media privacy), and Colorado's criminal video-surveillance statutes, together with the federal ECPA baseline. It does not re-derive Colorado's one-party consent recording rules or general GPS-tracking law; for those, see the linked Colorado recording law and GPS tracking law pages.
How Federal and Colorado Recording Law Apply to Employer Monitoring
Colorado is a one-party consent state for recording wire, oral, and electronic communications, meaning only one participant in a conversation needs to agree for a recording to be lawful under state law. This article does not re-derive that framework; for the full rules on consent, penalties, and exceptions, see Colorado Recording Laws.
A separate federal rule governs employer monitoring of business communications specifically. Under the Wiretap Act, 18 U.S.C. § 2511(2)(a)(i), a business that owns its phone or computer system can intercept communications on that system "in the ordinary course of business" without needing a party's consent at all. The Eleventh Circuit narrowed that exception in Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983): an employer can monitor a business call, but once a call is identified as personal, continued listening falls outside the exception, and the employer is expected to stop listening or rely on spot checks instead. Colorado has not layered a broader state-law monitoring rule on top of this federal baseline for ordinary phone and computer monitoring.
Colorado's SB 26-189 Is an AI Hiring Law, Not a Monitoring Notice Law
SB 26-189, titled "Automated Decision-Making Technology," was signed by Governor Polis on May 14, 2026, with its developer-facing requirements effective January 1, 2027. It repeals and replaces the original 2024 Colorado AI Act (SB 24-205) before that law's obligations ever fully took effect, and it substantially narrows what the earlier law would have required.
The law applies only when a covered automated decision-making tool materially influences a "consequential decision" about a worker, meaning hiring, termination, promotion, compensation, or scheduling. It does not create a general duty to notify employees before monitoring email, computer activity, or phone use, and it says nothing about video cameras, GPS tracking, or keystroke logging as such. Where it does apply, an employer (as "deployer") must notify the worker that a covered tool is being used and, within 30 days of an adverse decision, provide a plain-language explanation. Developers of the technology must supply deployers with technical documentation and retain compliance records for at least three years. Enforcement runs solely through the Colorado Attorney General as a deceptive trade practice; the statute does not give an individual worker a private right of action.
Several compliance blogs and vendor sites list Colorado alongside Connecticut, Delaware, New York, and Maine as a fourth state with a general electronic-monitoring notice statute. That characterization does not hold up against the bill text. SB 26-189 is triggered by the use of a specific category of AI tool in a specific category of employment decision, not by the fact of monitoring itself, and an Colorado employer that monitors employees without using automated decision-making technology to drive a consequential decision has no notice obligation under this law.
Colorado's Social Media Password Law
C.R.S. § 8-2-127, the Social Media and the Workplace Act, bars an employer from suggesting, requesting, or requiring that an employee or applicant disclose a username, password, or other means of accessing a personal social media account. Employers also cannot compel a worker to add the employer as a contact or to change the account's privacy settings, and they cannot discipline, penalize, or refuse to hire someone for declining to comply.
The statute's main exception covers an employer's own systems: it does not stop an employer from requiring credentials for nonpersonal accounts that provide access to the employer's internal computer or information systems, such as a company-issued email or social media account used for work. The law applies to both private and public Colorado employers, though it exempts the Department of Corrections, county corrections departments, and state or local law enforcement agencies. The Colorado Department of Labor and Employment investigates complaints and can impose a civil fine of up to $1,000 for a first violation and up to $5,000 for each subsequent violation.
Video and Audio Surveillance in the Colorado Workplace
Colorado addresses covert recording in private spaces through its criminal code rather than a labor statute. C.R.S. § 18-7-801, criminal invasion of privacy, makes it a class 2 misdemeanor to knowingly observe or photograph another person's intimate parts without consent in a place, such as a dressing room, restroom, or locker room, where that person has a reasonable expectation of privacy. A related eavesdropping statute, C.R.S. § 18-9-304, separately reaches concealed recording devices placed in private spaces, and Colorado's voyeurism statute, C.R.S. § 18-3-405.6, adds enhanced criminal exposure when the conduct is for sexual gratification.
None of these statutes is written as an employer-specific workplace surveillance law, but they apply to an employer's conduct the same as anyone else's. In practice, this means visible security cameras in common work areas generally do not raise a legal problem, while any camera capturing a restroom, locker room, or changing area does, regardless of a stated business justification. Colorado has no reported appellate decision applying these statutes specifically to an employer-installed camera, so the safest course for employers is to keep cameras out of those spaces entirely.
Colorado's Privacy Act Does Not Cover Employee Monitoring Data
Colorado's comprehensive consumer privacy statute, the Colorado Privacy Act, does not apply to data employers maintain for employment-records purposes, and it defines "consumer" to exclude an individual acting as an employee or job applicant. That is a meaningful difference from California, where the CPRA's employee exemption expired on January 1, 2023 and now gives California employees rights to know, delete, and correct personal data an employer collects, including monitoring data. Colorado employees do not have an equivalent CPA-based right to demand an accounting of what an employer's monitoring software has collected about them; whatever protection exists comes instead from the narrower statutes described elsewhere in this article, plus SB 26-189 where a covered AI tool is involved.
GPS and Vehicle Tracking
New Jersey remains the only state with a dedicated statute requiring an employer to give written notice before tracking a vehicle an employee uses, and Colorado has not adopted an equivalent law. Colorado's general tracking-device and stalking statutes are built around a lack of consent from the person being tracked, and an employer tracking a vehicle it owns typically falls outside that framework because the vehicle's owner, not a third party, is doing the tracking. No Colorado court has addressed how far that general framework extends to a company-vehicle dispute between an employer and its own employee. For the fuller rules on GPS and tracking devices in Colorado, see Colorado GPS Tracking Laws.
Biometric Monitoring and the Colorado AI Act
Colorado does not have an Illinois-style biometric privacy statute with a private right of action for employer misuse of fingerprint or facial-recognition data. Where Colorado has moved is on the AI side: SB 26-189 covers automated decision-making tools, which can include AI-driven biometric screening used to make a hiring or promotion decision, if that tool materially influences the outcome. For background on Colorado's broader AI regulatory framework, including the transition from SB 24-205 to SB 26-189, see Colorado AI Laws.
Recent and Pending Developments
Two 2026 developments are worth tracking. First, SB 26-189's effective date of January 1, 2027 means employers have a runway before its notice and adverse-action-explanation requirements bind them, though developers of covered tools face earlier documentation duties. Second, HB26-1210, which would have banned individualized wage-setting algorithms built on surveillance data collected from workers, passed both chambers of the General Assembly but was vetoed by Governor Polis on June 2, 2026. It is not currently law, but its passage through the legislature signals continued interest in regulating how employers use worker-monitoring data, not just whether they can collect it.
More Colorado Laws
- Colorado AI Meeting Recording Laws
- Colorado Alimony Laws
- Colorado At-Will Employment Laws
- Colorado Car Accident Laws
- Colorado Car Seat Laws
- Colorado Child Custody Laws
- Colorado Child Support Laws
- Colorado Common Law Marriage Laws
- Colorado Dashcam Laws
- Colorado Data Privacy Laws
- Colorado Deepfake Laws
- Colorado Divorce Laws
- Colorado Dog Bite Laws
- Colorado Drone Laws
- Colorado Emancipation Laws
- Colorado Expungement Laws
Disclaimer
This article provides general legal information about employee monitoring law in Colorado as of July 9, 2026. It is not legal advice and does not create an attorney-client relationship. Workplace privacy and employment law involve fact-specific analysis; consult an attorney licensed in Colorado about your specific situation before acting on anything in this article.
Related articles
- Employee Monitoring Laws by State
- Colorado Recording Laws
- Colorado GPS Tracking Laws
- Colorado AI Laws
- United States Recording Laws
Last updated: July 9, 2026. Statutes cited reflect their in-force version as of July 9, 2026.
Frequently Asked Questions
Does Colorado require employers to notify employees before monitoring email or internet use?
No. Colorado has no general electronic-monitoring notice statute comparable to Connecticut, Delaware, New York, or Maine. Ordinary monitoring of company email, phones, and computers is governed by the federal ECPA ordinary course of business exception, not a Colorado notice law.
Is Colorado's SB 26-189 a workplace monitoring notice law?
No. SB 26-189 requires notice and an adverse-action explanation only when a covered automated decision-making tool materially influences a consequential employment decision such as hiring, firing, promotion, compensation, or scheduling. It does not create a general duty to disclose email, phone, computer, or video monitoring.
Can my employer in Colorado ask for my social media password?
No, with a narrow exception. C.R.S. § 8-2-127 bars an employer from requiring your personal social media username or password, except for a nonpersonal account that accesses the employer's own systems. Violations can bring a Colorado Department of Labor and Employment fine of up to $1,000 for a first offense.
Can my employer put a camera in the Colorado break room?
Generally yes, in common work areas without a heightened expectation of privacy. Colorado's criminal invasion of privacy statute, C.R.S. § 18-7-801, and its eavesdropping statute, C.R.S. § 18-9-304, target cameras in restrooms, locker rooms, and similar private spaces, not ordinary break-room or hallway cameras.
Does Colorado's privacy law give me rights over my workplace monitoring data?
Not through the Colorado Privacy Act, which exempts employment records entirely. Colorado employees do not have the CPA-based right to know, delete, or correct monitoring data that California employees have under the CPRA. SB 26-189 provides narrower, AI-specific notice rights where a covered tool drives a consequential decision.
Is Colorado a one-party consent state for recording conversations?
Yes. Only one participant in a conversation needs to consent for a recording to be lawful under Colorado's wiretap statute. See Colorado Recording Laws for the full framework, including exceptions and penalties.
Can my employer track my company vehicle with GPS in Colorado?
Colorado has no dedicated statute like New Jersey's requiring written notice before an employer tracks a company-owned vehicle. General tracking and stalking statutes are built around lack of consent from the person tracked, and an employer tracking its own vehicle typically falls outside that framework, though this has not been tested in Colorado courts.
Sources and References
- 18 U.S.C. § 2511(2)(a)(i), Electronic Communications Privacy Act (ordinary course of business exception)(law.cornell.edu)
- Watkins v. L.M. Berry & Co., 704 F.2d 577 (11th Cir. 1983)(law.resource.org)
- SB26-189, Automated Decision-Making Technology, Colorado General Assembly (signed May 14, 2026)(leg.colorado.gov).gov
- Social Media and the Workplace Act, C.R.S. § 8-2-127, Colorado Department of Labor and Employment(cdle.colorado.gov).gov
- Social Media and the Workplace Law, Colorado Department of Labor and Employment(cdle.colorado.gov).gov
- C.R.S. § 18-7-801, Criminal invasion of privacy(colorado.public.law)
- Colorado Privacy Act overview, Colorado Attorney General(coag.gov).gov
- HB26-1210, Prohibit Surveillance Price and Wage Setting, Colorado General Assembly (vetoed June 2, 2026)(leg.colorado.gov).gov