EveryAILaw.com

HB 26-1263 was signed 2026-05-29 and adds subsections to C.R.S. § 6-1-1701 and adds § 6-1-1708 to part 17 of article 1 of title 6. SB 26-189, signed two weeks earlier on 2026-05-14, repeals and reenacts that same part 17 effective 2027-01-01 (tracked here as colorado-sb26-189). Whether § 6-1-1708 survives that repeal-and-reenactment unchanged is an open harmonization question for the revisor of statutes, and it lands on the same day these operator duties begin. Unresolved as of 2026-08-03 — no answer is asserted here. Separately, Colorado is the only 2026 state chatbot law that affirmatively requires age estimation by commercially reasonable or generally accepted methods and then deems the estimate to be knowledge of the minor's age, so age-blindness is not a defence. Note also that the age-estimation and willful-disregard sentences sit before the "on and after January 1, 2027" clause in the same paragraph; the 2027-01-01 date is recorded here because the clause governs the operator duties the estimate triggers.

The disclosure duty is written as prompt-responsive first — it "must be provided in response to user prompts regarding whether the service is artificially generated and not human" — and then specifies the delivery form by product type: a persistent visible disclaimer on screen products, an intermittent audio disclaimer on screenless products, or beginning-of-interaction plus a three-hour cadence. Colorado gives minors the same three-hour interval as adults, unlike Washington ESHB 2225, which drops the minor cadence to one hour.

Colorado sets two different standards of care inside the same subsection: sexual-content controls must be "technically feasible measures" (§ 6-1-1708(2)(c)) while emotional-dependence controls need only "reasonable measures" (§ 6-1-1708(2)(d)), so the sexual-content duty is the more demanding of the two. The emotional-dependence list reaches model behaviour rather than interface copy — the service must be prevented from explicitly claiming to be human or artificially sentient, from simulating romantic companionship, and from role-playing an adult-minor romantic relationship. The variable-reward ban at § 6-1-1708(2)(b) targets points or similar rewards at unpredictable intervals intended to increase engagement.

This is the provision with no analogue in the other 2026 state chatbot laws. The minor's own privacy tool must let the user turn off cross-session memory personalization — control over whether the service retains information from prior interactions or sessions to personalize future ones — and separately opt out of having their personal data used to train the service. No other state chatbot statute requires either control. Subsection (2)(g) also bolts on compliance with part 13 of article 1 of title 6, Colorado's existing minor-data privacy regime, so the operator inherits that part's duties by reference rather than restating them.

The general disclosure is unconditional — there is no reasonable-person trigger, so a plainly artificial service still discloses. Colorado's daily-reset cadence is distinctive: the disclosure is owed at the beginning of the user's first interaction for each day of interaction, then either every three hours in a continuous interaction or as a persistent visible disclosure. The false-representation bar at § 6-1-1708(5) covers four named professions — licensed health-care professionals, licensed legal professionals, licensed, certified, or registered mental health professionals, and qualified dietitians as described in § 6-1-707(1)(b) — and reaches advertising and interface copy as well as model outputs. Section 6-1-1708(7) preserves constitutional information access, does not require disclosure of trade secrets or confidential information, and does not authorize content moderation inconsistent with the United States Constitution.

Colorado expressly excludes referral to a law enforcement agency from the crisis protocol — the referral must go to a crisis service provider such as a suicide hotline or crisis text line, and the statute says "but not including a law enforcement agency." That carve-out is unique among the 2026 state chatbot laws and rules out the wellness-check escalation pattern several operators use today. The protocol must also carry escalation procedures for repeated or severe crisis indicators, so a single-response referral does not satisfy the section. The ability to sustain suicide or self-harm dialogue is itself part of what pulls a product into scope: several of the § 6-1-1701(3.5)(b) carve-outs are conditioned on the product being unable to maintain or encourage such dialogue.

This is a filing to a regulator, not a website self-disclosure — the contrast with Washington ESHB 2225 and Oregon, which require operators to publish crisis-referral counts themselves. It starts six months after the operator duties, on 2027-07-01, so the first report covers a period already under the § 6-1-1708(4) protocol. The Attorney General may expand the report by determining additional metrics necessary to judge the efficacy and reliability of safeguards, which is an open-ended content hook without a rulemaking procedure attached. Reports must exclude user identifiers and personal information, and measurement must use evidence-based methods.