Using a fingerprint time clock in Colorado? You need a written biometric policy.
Since July 1, 2025, Colorado law requires ANY business that collects biometric identifiers — fingerprint punch clocks, face-scan door access, voice ID — to have a written policy, give notice, and get consent first. This applies regardless of company size: the privacy law's 100,000-consumer threshold does not protect small employers here. Most haven't heard of it.
The facts (we read the bill — citations below)
- The duty applies to any amount of biometric data — the Colorado Privacy Act's size thresholds are expressly overridden for biometrics. (C.R.S. § 6-1-1304(1)(b), added by HB 24-1130)
- You need a written policy with three things: a retention schedule, a security-incident response protocol (wired to Colorado's 30-day breach-notice law, § 6-1-716), and deletion rules — delete by the earliest of: purpose satisfied, 24 months after last interaction, or 45 days after your at-least-annual review finds it unnecessary. (§ 6-1-1314(2)(a))
- A policy that covers only your current employees must exist in writing but does NOT have to be posted publicly. (§ 6-1-1314(2)(b))
- Before collecting, you must tell each person — clearly — what is collected, the specific purpose, how long you keep it, and whether a vendor processes it; and you must get consent. (§ 6-1-1314(4)(a),(e))
- Employers may require consent as a condition of employment ONLY for: timekeeping of the full workday, secure access to locations/systems (but not location tracking or app-time tracking), workplace safety/security, and emergencies. Anything else needs voluntary consent, with no retaliation. (§ 6-1-1314(6))
- Never sell, lease, or trade biometric identifiers; disclosure is tightly limited. (§ 6-1-1314(4)(b))
- Enforcement: Attorney General and district attorneys — there is no private lawsuit right (unlike Illinois' BIPA). The play is orderly compliance, not panic.
The policy kit — ready to deliver
A fixed-fee package ($495, delivered in 5 business days): the written biometric policy customized to your actual devices and vendor, the employee notice-and-consent form in English AND Spanish — built for workforces where Spanish is the first language — and a settings review of your timeclock/access system. Bundles with the $595 WISP data-security kit. Templates are readiness materials for your attorney's review, not legal advice.
Book a discovery callThe honest part
If your punch clock stores a mathematical template rather than an image, it is still a biometric identifier under this law — that distinction does not exempt you. But compliance here is genuinely small: one policy, one consent form, one annual review. If someone quotes you thousands of dollars or invokes Illinois-style class-action fear, they are importing another state's law: Colorado gives enforcement to the AG and DAs only.
General information verified against the bill text at leg.colorado.gov as of July 12, 2026 — not legal advice. Confirm your situation with a Colorado-licensed attorney.
Ready to put AI to work?
Book a free 30-minute discovery call. Plain language, in your language, no obligation.