Selling company data to AI companies in Colorado

This guide covers Colorado law for companies licensing records to AI buyers. Federal law and other states' laws still apply, as our US guide explains. Colorado matters to sellers for two reasons: a broad privacy law, and the most closely watched state AI statute, which changed twice in 2025 and 2026.

Does the Colorado Privacy Act apply to your company?

The Colorado Privacy Act applies to your company if it does business in Colorado or targets Coloradans, and either processes the personal data of more than 100,000 individuals in a calendar year or earns revenue or discounts from selling the personal data of 25,000 or more. The Colorado Attorney General says the Act took effect on July 1, 2023.

Section 6-1-1303(6) defines a consumer as a Colorado resident acting only in an individual or household context. It excludes anyone acting in a commercial or employment context, as a job applicant or as a beneficiary of someone acting in an employment context. Staff email and HR files about Coloradans in their work roles are therefore outside the Act.

Is licensing data to an AI company a sale under the Colorado Privacy Act?

Licensing personal data to an AI company for value is a sale under the Colorado Privacy Act. Section 6-1-1303(23)(a) defines a sale as the exchange of personal data for monetary or other valuable consideration by a controller to a third party.

Consumers can opt out of sales, and the Attorney General says controllers must accept universal opt-out requests from July 1, 2024. Sensitive data, which includes personal data about children under 13, needs consent. The Attorney General's rules sit at 4 CCR 904-3.

De-identified data is outside the Act if it meets the definition in section 6-1-1303(11). The data must not reasonably be usable to infer information about, or be linked to, an identified or identifiable individual, and the controller must meet three conditions.

• Take reasonable measures to ensure the data cannot be associated with an individual
• Publicly commit to maintain and use the data only in a de-identified fashion
• Contractually oblige any recipient to comply with the same definition

Do you need a data protection assessment before selling?

Section 6-1-1309 of the Colorado Privacy Act requires a controller to conduct and document a data protection assessment before processing that presents a heightened risk of harm, and selling personal data is one of the listed activities. Processing sensitive data is another. The duty covers personal data acquired on or after July 1, 2023, which includes most of an active company's recent records.

The assessment weighs the benefits of the processing against the risks to consumers and the safeguards that reduce them. For a data license, the same file answers most of a buyer's questions, so prepare it before the first sample leaves your systems.

Colorado has also extended its protections for minors. The Attorney General's page refers to SB24-041, Privacy Protections for Children's Online Data, and to 2025 rulemaking on it. Exclude data about children unless a lawyer has cleared it.

Who enforces the Colorado Privacy Act?

The Colorado Attorney General and district attorneys enforce the Colorado Privacy Act, and section 6-1-1311 says the Act creates no private right of action. The 60-day notice and cure process in section 6-1-1311(1)(d) was repealed effective January 1, 2025, so enforcers no longer have to offer a cure before acting.

Colorado's biometric rules require notice and consent before a controller collects a biometric identifier, plus a written policy with a retention schedule, an incident response protocol and deletion deadlines. They come from HB24-1130, which the Governor signed on May 31, 2024 and which took effect on July 1, 2025.

The Colorado General Assembly's summary says the bill also limits the reasons an employer may ask an employee to consent to biometric collection. For a seller, the practical effect is that voice, face and fingerprint data about Coloradans, including staff, needs its own review before any license. Our speech and audio data page covers what buyers ask about recordings.

What is the status of the Colorado AI Act in 2026?

The Colorado AI Act of 2024, SB24-205, no longer exists in its original form. Government Technology reports that SB25B-004, signed on August 28, 2025, delayed its enforcement from February 1, 2026 to June 30, 2026. In May 2026, SB26-189 repealed and replaced it before that date, according to Lathrop GPM.

Lathrop GPM says SB26-189 takes effect on January 1, 2027 and moves from risk management and impact assessments toward transparency and consumer rights. Deployers must tell consumers before automated decision-making technology materially influences a consequential decision and explain adverse decisions within 30 days.

Developers must give deployers information about intended uses, known limitations and the categories of data used to train the system, while protecting trade secrets. Lathrop GPM notes that the law does not restrict training data itself. Only the Attorney General can enforce it, with a 60-day cure period that sunsets on January 1, 2030.

Is Colorado a one-party consent state for call recordings?

Colorado is a one-party consent state for call recordings. It is not on the Reporters Committee for Freedom of the Press list of about 11 all-party consent states. Calls with people in all-party states such as California or Washington still need checking before you license them.

Which buyers accept Colorado sellers?

Buyers that accept US sellers accept Colorado companies. micro1 says demand is strongest in the US, Endless Data prioritizes the US, UK and Canada, and AWS Data Exchange lists the US as an eligible seller jurisdiction.

What are Colorado's rules at a glance?

What should a Colorado seller do before licensing?

A Colorado seller should settle which data will be de-identified and which excluded, then document the decision in a data protection assessment. The steps below follow the Colorado law cited above.

1. 1

   Check the thresholds

   Count the Coloradans in your records and check whether you earn revenue or discounts from selling data.

2. 2

   Separate staff data

   Staff and applicant data is outside the Act's definition of consumer, but biometric data about staff is not.

3. 3

   Remove sensitive and children's data

   Exclude sensitive data and data about children unless you hold the consent the Act requires.

4. 4

   Meet the de-identification conditions

   Apply reasonable measures, publish your commitment and bind the buyer by contract.

5. 5

   Document the assessment

   Record a data protection assessment for the sale and keep it with the license file.

For a view of which buyers fit your records and what to clear first, request a free data valuation.