EveryAILaw.comDoes Colorado Conversational AI Service Operator Requirements (HB 26-1263) require Data Governance?
Colorado • enacted
Yes — 1 provision
Requirements at a glance
This regulation imposes 5 specific requirements for Data Governance across 1 provision:
- Part 13 compliance — Comply with part 13 of article 1 of title 6 regarding protecting the privacy and data of a minor (§ 6-1-1708(2)(g))
- Minor privacy and account tools — Offer tools for the minor account holder or minor user to manage their privacy and account settings (§ 6-1-1708(2)(h)(I))
- Memory personalization control — Those tools must include the ability to control whether the service retains information from prior interactions or sessions for the purpose of personalizing the content of future interactions (§ 6-1-1708(2)(h)(I))
- Training-use control — Those tools must include the ability to control whether the minor's personal data is used for the purposes of training the conversational AI service (§ 6-1-1708(2)(h)(I))
- Parent and guardian tools — Offer tools for a parent or guardian of the minor to manage the minor's privacy and account settings (§ 6-1-1708(2)(h)(II))
Minor Privacy, Memory, and Parental Control Tools #
This is the provision with no analogue in the other 2026 state chatbot laws. The minor's own privacy tool must let the user turn off cross-session memory personalization — control over whether the service retains information from prior interactions or sessions to personalize future ones — and separately opt out of having their personal data used to train the service. No other state chatbot statute requires either control. Subsection (2)(g) also bolts on compliance with part 13 of article 1 of title 6, Colorado's existing minor-data privacy regime, so the operator inherits that part's duties by reference rather than restating them.
Requirements
| Requirement | Details |
|---|---|
| Part 13 compliance | Comply with part 13 of article 1 of title 6 regarding protecting the privacy and data of a minor (§ 6-1-1708(2)(g)) |
| Minor privacy and account tools | Offer tools for the minor account holder or minor user to manage their privacy and account settings (§ 6-1-1708(2)(h)(I)) |
| Memory personalization control | Those tools must include the ability to control whether the service retains information from prior interactions or sessions for the purpose of personalizing the content of future interactions (§ 6-1-1708(2)(h)(I)) |
| Training-use control | Those tools must include the ability to control whether the minor's personal data is used for the purposes of training the conversational AI service (§ 6-1-1708(2)(h)(I)) |
| Parent and guardian tools | Offer tools for a parent or guardian of the minor to manage the minor's privacy and account settings (§ 6-1-1708(2)(h)(II)) |
Penalties
| Violation | Fine |
|---|---|
| Enforcement route | Added to part 17 of article 1 of title 6, so enforcement runs through the Colorado Consumer Protection Act with the Attorney General |
| Penalty amount | HB 26-1263 sets no penalty amount |
| Private right of action | HB 26-1263 creates no private right of action |