EveryAILaw.com

The 2026 C.R.S. publishes the section as § 6-1-1708 through 2026-12-31, then expressly harmonizes it with SB 26-189 and relocates it to § 6-1-1710 effective 2027-01-01. The separate predecessor-framework operative history remains unresolved, and no court interpretation is claimed. Colorado requires age estimation by commercially reasonable or generally accepted methods and deems the estimate to be knowledge of the minor's age. The age-estimation and willful-disregard sentences sit before the "on and after January 1, 2027" clause in the same paragraph. The saved pending status and 2027-01-01 date describe the minor-triggered duties in the list, not a resolved conclusion that the preceding age-estimation commands have no effect before 2027. The official bill summary broadly describes 2027 commencement; this textual timing question remains unresolved.

The disclosure duty is written as prompt-responsive first — it "must be provided in response to user prompts regarding whether the service is artificially generated and not human" — and then specifies the delivery form by product type: a persistent visible disclaimer on screen products, an intermittent audio disclaimer on screenless products, or beginning-of-interaction plus a three-hour cadence. Colorado gives minors the same three-hour interval as adults, unlike Washington ESHB 2225, which drops the minor cadence to one hour.

Colorado states two different measures inside the same subsection: sexual-content controls must be "technically feasible measures" (§ 6-1-1708(2)(c)) while emotional-dependence controls require "reasonable measures" (§ 6-1-1708(2)(d)). The text does not rank which standard is more demanding in every application. The emotional-dependence list reaches model behaviour rather than interface copy — the service must be prevented from explicitly claiming to be human or artificially sentient, from simulating romantic companionship, and from role-playing an adult-minor romantic relationship. The variable-reward ban at § 6-1-1708(2)(b) targets points or similar rewards at unpredictable intervals intended to increase engagement.

This provision requires specific minor privacy controls. The minor's own privacy tool must let the user turn off cross-session memory personalization — control over whether the service retains information from prior interactions or sessions to personalize future ones — and separately opt out of having their personal data used to train the service. The source review does not establish whether other states require similar controls. Subsection (2)(g) also bolts on compliance with part 13 of article 1 of title 6, Colorado's existing minor-data privacy regime, so the operator inherits that part's duties by reference rather than restating them.

The general disclosure is unconditional — there is no reasonable-person trigger, so a plainly artificial service still discloses. Colorado's daily-reset cadence is distinctive: the disclosure is owed at the beginning of the user's first interaction for each day of interaction, then either every three hours in a continuous interaction or as a persistent visible disclosure. The false-representation bar at § 6-1-1708(5) covers four named professions — licensed health-care professionals, licensed legal professionals, licensed, certified, or registered mental health professionals, and qualified dietitians as described in § 6-1-707(1)(b) — and reaches advertising and interface copy as well as model outputs. Section 6-1-1708(7) preserves constitutional information access, does not require disclosure of trade secrets or confidential information, and does not authorize content moderation inconsistent with the United States Constitution.

Colorado expressly excludes referral to a law enforcement agency from the crisis protocol — the referral must go to a crisis service provider such as a suicide hotline or crisis text line, and the statute says "but not including a law enforcement agency." The exclusion applies to the required crisis-service referral. The text does not resolve every possible separate welfare-check or escalation practice, and a claim of uniqueness would require a separate comparative source review. The protocol must also carry escalation procedures for repeated or severe crisis indicators, so a single-response referral does not satisfy the section. The ability to sustain suicide or self-harm dialogue is itself part of what pulls a product into scope: several of the § 6-1-1701(3.5)(b) carve-outs are conditioned on the product being unable to maintain or encourage such dialogue.

This is a filing to a regulator, not a website self-disclosure — the contrast with Washington ESHB 2225 and Oregon, which require operators to publish crisis-referral counts themselves. It starts on 2027-07-01. The statute calls for the preceding calendar year's referral count but does not state an exact first filing date, so the first reporting period and its relationship to the 2027-01-01 protocol commencement remain unresolved. The Attorney General may expand the report by determining additional metrics necessary to judge the efficacy and reliability of safeguards, which is an open-ended content hook without a rulemaking procedure attached. Reports must exclude user identifiers and personal information, and measurement must use evidence-based methods.