CO SB26-189: Automated Decision-Making Technology
Colorado's SB26-189 introduces new obligations for businesses using automated decision-making technology (ADMT), including risk assessments, consumer notices, and opt-out rights, with enforcement starting in 2026.
Aforeworn detected this change in the US State Data-Privacy Laws space on August 18, 2026 and published this briefing so affected operators are forewarned rather than caught off guard. It is rated High urgency. Multistate retailers, adtech/data brokers, SaaS platforms, and privacy consultants operating in Colorado or processing Colorado residents' data. should confirm how it applies to their specific situation before acting. There is a time constraint attached: Enforcement begins January 1, 2026 (per bill text).. Acting after that point can mean penalties, a lapsed licence, or lost eligibility — exactly the kind of surprise Aforeworn exists to prevent. Aforeworn monitors US State Data-Privacy Laws continuously and turns every detected change into a plain-English briefing like this one, so you always know first. Forewarned is forearmed.
What changed
New requirements for ADMT: conduct risk assessments, provide consumer notices, and honor opt-out rights for automated decisions.
Who it affects
Multistate retailers, adtech/data brokers, SaaS platforms, and privacy consultants operating in Colorado or processing Colorado residents' data.
What you must do
Review current ADMT usage, conduct risk assessments, update privacy policies, and implement opt-out mechanisms.
Deadline
Enforcement begins January 1, 2026 (per bill text).
Source: https://leg.colorado.gov/bills
Never miss a change like this again
Aforeworn watches US State Data-Privacy Laws around the clock and alerts you the moment a rule moves — with a plain-English brief on what to do.
Start your free trialRelated changes in US State Data-Privacy Laws
- CalPrivacy Settles with Two Data Brokers over Registration Failures and Privacy Violations - hunton.com
- CalPrivacy Authorizes Rulemaking on Opt-Out Signals, Raises Data Broker Fees, and Starts the Clock on DROP Amendment Comment Period - Wilson Sonsini
- ICYMI: California takes historic action against data brokers - gov.ca.gov
- California Agency Fines Iowa Data Broker $116,490 in First Dual Enforcement Action - Palisades News
- Update on New Jersey’s New Data Broker Rule - jdsupra.com