Ban Government Access Historical Location Information Database

Second Regular Session Seventy-fifth General Assembly STATE OF COLORADO INTRODUCED SENATE BILL 26-070 LLS NO. 26-0400.01 Owen Hatch x2698 SENATE SPONSORSHIP Amabile and Zamora Wilson, Gonzales J., Hinrichsen, Marchman, Wallace HOUSE SPONSORSHIP Zokaie and Nguyen, Brown, Camacho, Garcia, Lieder, Martinez, McCormick, Smith, Titone, Velasco Senate Committees House Committees Judiciary A BILL FOR AN ACT CONCERNING PROHIBITING A GOVERNMENT ENTITY FROM ACCESSING A INFORMATION.

DATABASE THAT STORES HISTORICAL LOCATION Bill Summary (Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.) The bill prohibits a government entity from accessing a database that reveals an individual's or a vehicle's historical location information, subject to certain exceptions. The bill prohibits a government entity from sharing historical location information with third parties or government agencies outside their jurisdiction, subject to certain exceptions, and Shading denotes HOUSE amendment. Double underlining denotes SENATE amendment.

Capital letters or bold & italic numbers indicate new material to be added to existing law. Dashes through the words or numbers indicate deletions from existing law.

makes historical location information not a public record for the purposes of the "Colorado Open Records Act". The bill requires a government entity that collects historical location information to adopt a policy to maintain compliance with the provisions of the regulatory scheme. An enforcement action is created for the attorney general to enforce the provisions of the bill. Historical location information obtained in violation of the prohibitions of the bill are inadmissible in trial.

Be it enacted by the General Assembly of the State of Colorado:

SECTION 1. Short title. The short title of this act is the "Protecting Everyone from Excessive Police Surveillance (PEEPS) Act" or "PEEPS Act".

SECTION 2.

Legislative declaration - legislative intent.

(1) The general assembly finds and declares that:

(a) Technological advances and the growth of commercial data systems have enabled the routine collection, aggregation, storage, and sale of historical location information relating to individuals and vehicles, including information derived from cameras, license plate readers, cellular networks, and other technologies;

(b) Historical location information is highly sensitive in nature and, when accessed over time, can reveal detailed and personal information about an individual's movements, associations, habits, and daily activities;

(c) Government access to historical location information through privately or publicly maintained databases, rather than through direct observation or narrowly targeted collection, presents unique risks of overbroad surveillance and may occur outside traditional legal processes and safeguards;

(d) The availability of commercial and third-party databases containing historical location information has created pathways for government entities to obtain such information without a warrant, court order, or clearly articulated statutory authority;

(e) Sharing of historical location information with third parties or with government agencies outside a government entity's jurisdiction, absent clear limits and accountability measures, increases the risk of misuse, unauthorized secondary use, and erosion of public trust;

(f) Establishing clear statutory guardrails governing when and how government entities may access, use, and share historical location information promotes transparency, accountability, and consistent application of privacy protections across jurisdictions; and (g) The general assembly recognizes the essential role of government entities, including law enforcement and emergency service providers, in protecting public safety, and acknowledges that limited and clearly defined exceptions are necessary to allow appropriate access to historical location information in specific circumstances.

(2) It is the general assembly's intent to regulate government access to databases containing historical location information; to restrict the sharing of such information, except in narrow, well-defined circumstances; to require oversight, record keeping, and compliance policies when historical location information is collected; and to ensure meaningful remedies and enforcement for violations of these protections.

SECTION 3. In Colorado Revised Statutes, add 16-3-313 as follows:

16-3-313. Prohibition on access to a historical location information database - individual or vehicle - evidence inadmissible in court - definitions.

(1) AS USED IN THIS SECTION, UNLESS THE CONTEXT OTHERWISE REQUIRES:

(a) "ACCESS" MEANS VIEWING, QUERYING, RETRIEVING, COPYING, TRANSMITTING, ANALYZING, OR OTHERWISE USING A DATABASE AS DEFINED IN THIS SECTION, WHETHER MANUALLY OR AUTOMATICALLY.

(b) "COLLECT" MEANS USING TECHNOLOGY TO RECORD INFORMATION ABOUT AN INDIVIDUAL'S OR VEHICLE'S PHYSICAL LOCATIONS OR MOVEMENTS.

(c) "DATABASE" MEANS A PHYSICAL OR DIGITAL INFORMATION STORAGE SYSTEM, WHETHER PUBLICLY OR PRIVATELY OWNED, THAT CONTAINS PHOTOS, VIDEOS, LICENSE PLATE DATA, FACIAL RECOGNITION DATA, CELL SITE LOCATION DATA, OR ANY COMBINATION OF THESE.

(d) "GOVERNMENT ENTITY" HAS THE MEANING SET FORTH IN SECTION 16-3-303.5.

(e) "GOVERNMENT OFFICIAL" MEANS ANY OFFICER, EMPLOYEE, AGENT, CONTRACTOR, OR REPRESENTATIVE OF A GOVERNMENT ENTITY.

(f) (I) "HISTORICAL LOCATION INFORMATION" MEANS INFORMATION THAT, WHEN ACCESSED, REVEALS THE LOCATIONS OF AN INDIVIDUAL OR VEHICLE MORE THAN TWENTY-FOUR HOURS PRIOR TO THE DATE OF THE ACCESS.

(II) "HISTORICAL LOCATION INFORMATION" DOES NOT INCLUDE VIDEO GOVERNMENT-OWNED BUILDINGS OR DASHBOARD CAMERAS AND BODY-WORN CAMERAS OWNED AND OPERATED BY A GOVERNMENT ENTITY, REGARDLESS OF WHETHER THE CAMERA TRANSMITS, STORES, OR BACKS UP A RECORDING TO A LOCAL OR CENTRALIZED STORAGE SYSTEM, SO LONG AS:

OR IMAGE RECORDINGS GENERATED BY CAMERAS IN

(A) THE RECORDING IS NOT INDEXED, SEARCHABLE, OR ANALYZED BY A UNIQUE IDENTIFIER, INCLUDING AN IDENTIFIER TIED TO A VEHICLE OR INDIVIDUAL, SUCH AS A BIOMETRIC IDENTIFIER, BUT NOT INCLUDING AN IDENTIFIER FOR THE INDIVIDUAL OR VEHICLE CARRYING THE CAMERA OR AN IDENTIFIER CONNECTING THE RECORDING TO A PARTICULAR CASE OR INCIDENT NUMBER, FOR THE PURPOSE OF TRACKING OR RECONSTRUCTING AN INDIVIDUAL'S OR VEHICLE'S HISTORICAL LOCATION INFORMATION; AND (B) ACCESS TO THE RECORDING DOES NOT REVEAL AN INDIVIDUAL'S OR VEHICLE'S HISTORICAL LOCATION INFORMATION THROUGH A DATABASE QUERY OR SIMILAR SEARCH PROCESS.

(g) "SUPERVISOR" MEANS A GOVERNMENT OFFICIAL WHO POSSESSES THE AUTHORITY TO DIRECT AND DISCIPLINE ONE OR MORE GOVERNMENT OFFICIALS WITHIN A GOVERNMENT ENTITY.

(h) "WARRANT" HAS THE MEANING SET FORTH IN THIS ARTICLE 3. "WARRANT" DOES NOT MEAN A SUBPOENA. (2) A GOVERNMENT OFFICIAL SHALL NOT ACCESS A DATABASE THAT REVEALS HISTORICAL LOCATION INFORMATION, EXCEPT:

(a) WHEN THE GOVERNMENT OFFICIAL HAS OBTAINED A VALID JUDICIAL WARRANT ISSUED PURSUANT TO THIS PART 3 TO ACCESS THE DATABASE;

(b) WHEN AN INDIVIDUAL GIVES EXPRESS CONSENT TO THEIR SPECIFIC HISTORICAL LOCATION INFORMATION BEING REVEALED TO A SPECIFIC GOVERNMENT OFFICIAL OR ENTITY, SO LONG AS THE CONSENT DOES NOT ALLOW THE GOVERNMENT OFFICIAL OR ENTITY TO ACCESS THE HISTORICAL LOCATION INFORMATION OF AN INDIVIDUAL WHO HAS NOT CONSENTED;

(c) WHEN THE REGISTERED OWNER OF A VEHICLE REPORTS THE VEHICLE LOST OR STOLEN AND VOLUNTARILY CONSENTS TO THE VEHICLE'S HISTORICAL LOCATION INFORMATION BEING SEARCHED;

(d) WHEN EXIGENT CIRCUMSTANCES MAKE OBTAINING A WARRANT IMPRACTICAL BEFORE THE EXIGENCY EXPIRES; OR

(e) WHEN A GOVERNMENT OFFICIAL IS CARRYING OUT ANY OF THE FOLLOWING PURPOSES AND USES THE HISTORICAL LOCATION INFORMATION SOLELY FOR THE PURPOSE OF:

(I) TOLL COLLECTION AND ENFORCEMENT, AUTHORIZED PURSUANT TO SECTION 43-4-808;

(II) TRAFFIC ENFORCEMENT, AUTHORIZED PURSUANT TO SECTION 42-4-110.5;

(III) PARKING ENFORCEMENT; OR

(IV) INFORMATION SECURITY AS NECESSARY TO IMPLEMENT THE REQUIREMENTS OF SUBSECTION (3) OF THIS SECTION.

(3) (a) A GOVERNMENT OFFICIAL OR ENTITY THAT COLLECTS HISTORICAL LOCATION INFORMATION SHALL NOT SHARE IT OUTSIDE THE OFFICIAL'S OR ENTITY'S JURISDICTION, EXCEPT FOR A REASON SET FORTH IN SUBSECTION (2) OF THIS SECTION OR PURSUANT TO A VALID COURT ORDER.

(b) (I) A GOVERNMENT OFFICIAL OR ENTITY THAT COLLECTS HISTORICAL LOCATION INFORMATION SHALL NOT SELL OR CONVEY IT TO A PRIVATE, NONGOVERNMENTAL THIRD PARTY FOR ANY REASON, WHETHER AS A MARKET TRANSACTION, A RESPONSE TO A PUBLIC RECORDS REQUEST, OR OTHERWISE, EXCEPT TO THE LIMITED EXTENT NECESSARY FOR A NONGOVERNMENTAL THIRD PARTY VENDOR, ACTING SOLELY AS A SERVICE PROVIDER TO THE GOVERNMENT OFFICIAL OR ENTITY, TO TEMPORARILY ACCESS THE HISTORICAL LOCATION INFORMATION FOR THE SOLE MAINTENANCE ON A TECHNICAL MALFUNCTION OR SOFTWARE DEFECT IN THE SYSTEM USED TO COLLECT THE HISTORICAL LOCATION INFORMATION.

(II) ACCESS BY A NONGOVERNMENTAL THIRD PARTY VENDOR TO PURPOSE OF DIAGNOSING , REPAIRING, OR CONDUCTING HISTORICAL LOCATION INFORMATION SHALL:

(A) BE LIMITED IN SCOPE AND DURATION TO THE MINIMUM EXTENT NECESSARY TO RESOLVE THE IDENTIFIED MALFUNCTION OR DEFECT;

(B) PROHIBIT THE VENDOR FROM RETAINING, COPYING, AGGREGATING, ANALYZING, OR USING THE HISTORICAL LOCATION INFORMATION FOR ANY PURPOSE OTHER THAN RESOLVING THE MALFUNCTION OR DEFECT;

(C) PROHIBIT THE VENDOR FROM DISCLOSING THE HISTORICAL LOCATION INFORMATION TO ANY OTHER INDIVIDUAL OR ENTITY, UNLESS THE INDIVIDUAL OR ENTITY IS REQUIRED FOR ASSISTANCE IN RESOLVING THE MALFUNCTION OR DEFECT; AND

(D) REQUIRE THE VENDOR TO DELETE OR OTHERWISE RELINQUISH ACCESS TO THE HISTORICAL LOCATION INFORMATION IMMEDIATELY UPON RESOLUTION OF THE MALFUNCTION OR DEFECT.

(c) A GOVERNMENT OFFICIAL OR ENTITY THAT COLLECTS HISTORICAL LOCATION INFORMATION SHALL ADOPT A POLICY FOR COMPLIANCE WITH THIS SECTION THAT ENSURES:

(I) THE SECURITY AND ACCESS REGULATIONS OF THIS SECTION ARE ADHERED TO;

(II) THAT HISTORICAL LOCATION INFORMATION IS ENCRYPTED OR OTHERWISE RENDERED UNREADABLE TO AN UNAUTHORIZED USER USING METHODOLOGY OR TECHNOLOGY GENERALLY ACCEPTED IN THE FIELD OF INFORMATION SECURITY;

(III) THAT A GOVERNMENT OFFICIAL DOES NOT ACCESS A DATABASE CONTAINING HISTORICAL LOCATION INFORMATION, ABSENT A SHOWING TO A SUPERVISOR, AND, WITH WRITTEN APPROVAL FROM THE SUPERVISOR, THAT THE ACCESS COMPLIES WITH SUBSECTION (2) OF THIS SECTION;

(IV) A RECORD IS CREATED AND MAINTAINED EACH TIME HISTORICAL LOCATION INFORMATION IS ACCESSED. THE RECORD MUST INCLUDE:

(A) THE IDENTITY OF THE GOVERNMENT OFFICIAL AND ENTITY SEEKING ACCESS;

(B) THE SPECIFIC PURPOSE FOR WHICH ACCESS WAS SOUGHT;

(C) THE APPLICABLE EXCEPTION AS LISTED IN SUBSECTION (2) OF THIS SECTION AND THE SPECIFIC FACTUAL BASIS FOR THE SUPERVISOR BELIEVING THE EXCEPTION WAS APPLICABLE;

(D) THE SUPERVISOR'S WRITTEN APPROVAL THAT GRANTED ACCESS;

(E) THE FULL DESCRIPTION OF THE HISTORICAL LOCATION INFORMATION ACCESSED; AND

(F) REDACTIONS FOR LICENSE PLATE NUMBERS, FACIAL IMAGES, OR OTHER PERSONALLY IDENTIFIABLE INFORMATION;

(V) THAT THE RECORDS REQUIRED PURSUANT TO SUBSECTION (3)(c)(IV) OF THIS SECTION ARE AUDITED BY ONE OR MORE SUPERVISORS AT LEAST EVERY NINETY DAYS TO ENSURE COMPLIANCE WITH THIS SECTION. THE GOVERNMENT OFFICIAL OR ENTITY SHALL CREATE A WRITTEN STANDARDIZED POLICY OR PRACTICE FOR AN AUDIT THAT REQUIRES, AT MINIMUM:

(A) VERIFICATION THAT ALL INFORMATION REQUIRED PURSUANT TO SUBSECTION (3)(c)(IV) OF THIS SECTION HAS BEEN PROVIDED;

(B) VERIFICATION THAT THE SPECIFIC PURPOSE FOR WHICH ACCESS WAS SOUGHT COMPLIES WITH THIS SECTION;

(C) VERIFICATION THAT THE SCOPE OF THE HISTORICAL LOCATION INFORMATION ACCESSED COMPLIES WITH THIS SECTION; AND

(D) THAT IN THE EVENT THE AUDITOR OR AUDITORS DETERMINE OR HAVE REASON TO BELIEVE THAT A GOVERNMENT OFFICIAL OR ENTITY HAS VIOLATED ANY PROVISION OF THIS SECTION, FURTHER INVESTIGATION OF THE ACTUAL OR SUSPECTED VIOLATION;

(VI) THE CREATION AND MAINTENANCE OF AN ANNUAL REPORT THAT BOTH COMPILES AND SUMMARIZES THE RECORDS DESCRIBED IN SUBSECTION (3)(c)(IV) OF THIS SECTION. THE REPORT MUST BE MADE AVAILABLE BY JUNE 30 OF EACH YEAR TO THE PUBLIC. THE ANNUAL REPORT MUST INCLUDE THE NUMBER AND TYPE OF TECHNOLOGY DEVICES HELD BY A GOVERNMENT ENTITY THAT CAN COLLECT AN INDIVIDUAL'S OR VEHICLE'S PHYSICAL LOCATION OR MOVEMENTS, AND THE LOCATION WHERE THE DEVICES ARE DEPLOYED.

(VII) THAT ALL GOVERNMENT OFFICIALS WHOSE DUTIES INCLUDE ACCESSING A DATABASE THAT CONTAINS HISTORICAL LOCATION INFORMATION COMPLETE TRAINING ON HOW TO COMPLY WITH THIS SECTION AND THE COMPLIANCE POLICY ADOPTED PURSUANT TO THIS SECTION. THE TRAINING MUST NOT BE CREATED OR ADMINISTRATED BY A PRIVATE ENTITY WHOSE BUSINESS INVOLVES COLLECTING HISTORICAL LOCATION INFORMATION.

(d) (I) EXCEPT AS PROVIDED IN SUBSECTION (3)(d)(II) OF THIS SECTION, A GOVERNMENT OFFICIAL OR ENTITY THAT COLLECTS HISTORICAL LOCATION INFORMATION SHALL NOT RETAIN THE INFORMATION FOR MORE THAN FOUR DAYS AFTER THE DATE THE INFORMATION IS COLLECTED.

(II) HISTORICAL LOCATION INFORMATION THAT WAS ACCESSED IN COMPLIANCE WITH SUBSECTION (2) OF THIS SECTION MAY ONLY BE RETAINED FOR FIVE DAYS OR MORE IF:

(A) A VALID JUDICIAL WARRANT OR VALID COURT ORDER EXPRESSLY AUTHORIZES THE GOVERNMENT OFFICIAL OR ENTITY TO RETAIN THE HISTORICAL LOCATION INFORMATION FOR A PERIOD OF FIVE DAYS OR LONGER; OR

(B) THE INFORMATION IS NECESSARY TO PRESERVE EVIDENCE IN AN ACTIVE CRIMINAL INVESTIGATION OR OTHER LEGAL PROCEEDING AND THE DETERMINATION, BASED ON SPECIFIC AND ARTICULABLE FACTS, THAT RETAINING THE HISTORICAL LOCATION INFORMATION FOR FIVE DAYS OR MORE IS REQUIRED; OR SUPERVISOR OF THE INVESTIGATION MAKES A WRITTEN

(C) AN INDIVIDUAL GIVES EXPRESS CONSENT TO THEIR SPECIFIC HISTORICAL LOCATION INFORMATION BEING REVEALED TO A SPECIFIC GOVERNMENT OFFICIAL OR ENTITY AND CONSENTS TO THEIR HISTORICAL LOCATION INFORMATION BEING KEPT FOR FIVE DAYS OR MORE, SO LONG AS THE CONSENT DOES NOT ALLOW THE GOVERNMENT OFFICIAL OR ENTITY TO ACCESS THE HISTORICAL LOCATION INFORMATION OF AN INDIVIDUAL WHO HAS NOT CONSENTED.

(III) UPON EXPIRATION OF THE APPLICABLE RETENTION PERIOD DESCRIBED IN THIS SUBSECTION (3)(d), THE GOVERNMENT OFFICIAL OR ENTITY SHALL PERMANENTLY DESTROY THE HISTORICAL LOCATION INFORMATION AND ANY COPIES OF THE INFORMATION IN A MANNER THAT RENDERS THE INFORMATION UNRECOVERABLE.

(IV) THE COMPLIANCE POLICY REQUIRED PURSUANT TO SUBSECTION (3)(c) OF THIS SECTION MUST INCLUDE PROCEDURES TO ENSURE INFORMATION REQUIRED PURSUANT TO THIS SUBSECTION (3)(d) AND VERIFICATION OF DESTRUCTION.

TIMELY

(4) (a) DESTRUCTION OF THE HISTORICAL LOCATION HISTORICAL LOCATION INFORMATION ACCESSED IN VIOLATION OF THIS SECTION IS NOT ADMISSIBLE AS EVIDENCE IN ANY CRIMINAL OR CIVIL PROCEEDING OR ANY OTHER JUDICIAL, QUASI-JUDICIAL, OR ADMINISTRATIVE HEARING OR PROCEEDING.

(b) A GOVERNMENT ENTITY SHALL HAVE A WRITTEN, MANDATORY DISCIPLINARY POLICY THAT INCLUDES PROVISIONS FOR SUSPENDING OR REVOKING A GOVERNMENT OFFICIAL'S ACCESS TO ANY DATABASE THAT INCLUDES HISTORICAL LOCATION INFORMATION WHEN THE GOVERNMENT OFFICIAL VIOLATES ANY PROVISION OF THIS SECTION. A GOVERNMENT ENTITY SHALL NOT DEVIATE FROM ITS WRITTEN DISCIPLINARY POLICY AFTER A FINDING THAT A GOVERNMENT OFFICIAL VIOLATED A PROVISION OF THIS SECTION.

(5) A POLITICAL SUBDIVISION OF THE STATE SHALL NOT ADOPT A LAW OR POLICY THAT ALLOWS GOVERNMENT OFFICIALS OR ENTITIES TO ACCESS HISTORICAL LOCATION INFORMATION IN A MANNER LESS RESTRICTIVE THAN PROVIDED IN THIS SECTION.

(6) FOR PURPOSES OF THIS SECTION, A SUBPOENA IS NOT A VALID COURT ORDER.

SECTION 4. In Colorado Revised Statutes, 24-72-202, amend (6)(b)(XVII) and (6)(b)(XVIII); and add (6)(b)(XIX) as follows:

24-72-202. Definitions.

As used in this part 2, unless the context otherwise requires:

(6) (b) "Public records" does not include:

(XVII) A complaint of harassment or discrimination, as described in section 22-1-143, that is unsubstantiated and all records related to the unsubstantiated complaint, including records of an investigation into the complaint; or

(XVIII) Jail assessments conducted pursuant to section 30-10-530 (5)(d) or 24-31-118; OR (XIX) HISTORICAL LOCATION INFORMATION, AS DEFINED IN

SECTION 16-3-313 (1).

SECTION 5.

Act subject to petition - effective date - applicability. (1) This act takes effect at 12:01 a.m. on the day following the expiration of the ninety-day period after final adjournment of the general assembly (August 12, 2026, if adjournment sine die is on May 13, 2026); except that, if a referendum petition is filed pursuant to section 1

(3) of article V of the state constitution against this act or an item, section, or part of this act within such period, then the act, item, section, or part will not take effect unless approved by the people at the general election to be held in November 2026 and, in such case, will take effect on the date of the official declaration of the vote thereon by the governor.

(2) This act applies to violations on or after the applicable effective date of this act.