Your Face, Your Voice, and Deepfakes: What Happened to Colorado's Biometric Privacy Bill?

What This Bill Actually Does

Let's talk about House Bill 26-1049. In an era where artificial intelligence can clone a voice from a ten-second TikTok or generate a hyper-realistic video of you doing something you never did, Colorado lawmakers tried to draw a hard line in the digital sand. The bill aimed to create a brand-new crime: the unlawful use of a personally identifying feature. Under this proposal, it would have been illegal to use someone's fingerprint, voiceprint, retina or iris scan, or facial map in an advertisement, video, or deepfake without explicit permission.

The proposed penalties had real teeth. Simply using someone's biometric data without consent to create a digital depiction would have triggered a Class 5 felony. If the user explicitly intended to cause physical, emotional, or financial harm—think revenge porn, political smears, or voice-cloning ransom scams—that bumped the crime up to a Class 4 felony. On top of the criminal charges, the legislation proposed adding Section 18-5-906 to the Colorado Revised Statutes, which would have opened the door for civil lawsuits. Victims could have sued the creators of unauthorized deepfakes for limitless damages and attorney fees, turning an annoyance into a serious legal liability.

But the bill wasn't a blanket ban on all digital depictions. It included several crucial carve-outs to protect the First Amendment. If a journalist used your face in a news broadcast, or a comedian used your voice in a satire or parody, they were completely exempt. The bill also protected fleeting or incidental uses—like walking through the background of someone's vlog. It also referenced federal copyright law (17 U.S.C. Sec. 101) to protect audiovisual works, meaning filmmakers could still cast actors to play real people, provided the movie didn't try to trick the audience into thinking it was an authentic, documentary-style recording of the actual person. Essentially, the bill targeted bad actors using technology to exploit or impersonate individuals for profit or malice, while carefully side-stepping legitimate free speech.

What It Means for You

If you spend any time on the internet, this bill was looking out for your digital privacy. We have all seen the headlines about scammers cloning a child's voice to fake a kidnapping, or bad actors using AI to paste a teenager's face into inappropriate videos. HB26-1049 was designed to give everyday Coloradans a legal shield against these rapidly evolving threats. It wasn't just about throwing people in jail; it was about giving you the power to fight back in civil court and hit impersonators in the wallet by claiming a legally cognizable harm.

Because the bill was postponed indefinitely (legislative speak for "killed"), that specific legal shield isn't coming to Colorado this year. That means if someone creates a malicious deepfake of you, law enforcement and prosecutors will have to rely on existing, sometimes clunky statutes—like identity theft, harassment, or extortion laws—to go after them. The lack of a specific, targeted biometric law means proving harm and securing damages in civil court remains a complex, uphill battle for private citizens.

Even though the bill failed, the threat of digital impersonation is incredibly real and growing faster than the law can keep up with. Here is what you should do to protect yourself and your family right now:

• Lock down your social media: Limit public access to high-quality videos and audio of yourself and your kids. The less raw data bad actors have, the harder it is to train AI on your likeness.
• Establish a family safe word: If you receive a frantic, high-pressure phone call from a loved one asking for money or claiming they are in trouble, ask for the safe word. Voice cloning is highly sophisticated, but it cannot guess a secret password.
• Monitor your digital footprint: Set up Google Alerts for your name to keep an eye on where your image or identity might be popping up online without your consent.

What It Means for Your Business

For Colorado business owners, HB26-1049 would have been a massive wake-up call for your marketing and human resources departments. If you run a local auto dealership, a real estate firm, or a tech startup, the ways you use imagery and voiceovers were squarely in the crosshairs. Using a customer's face or an employee's voice in a promotional video without an ironclad consent form could have exposed your company to severe civil liabilities and, in extreme cases, felony charges. The bill explicitly targeted the use of personally identifying features in advertisements and commercial announcements.

The failure of this bill gives the business community a temporary breather, but you shouldn't get complacent. The fact that this legislation was introduced by bipartisan sponsors (Republican Rep. Bottoms and Republican Sen. Baisley) signals that biometric privacy is heavily on the legislature's radar. Future versions of this bill are highly likely as AI marketing tools become cheaper and more ubiquitous. If your marketing agency is using AI to generate voiceovers that sound suspiciously like local celebrities, or if you are scraping public social media profiles for your ad campaigns without explicit permission, you are playing with fire.

Even without this specific law on the books this year, you need to protect your business from future liabilities and existing privacy laws. Here are three specific things you should execute this week:

• Audit your media release forms: Ensure every employee, contractor, and customer who appears in your marketing materials signs a release that specifically mentions the authorized use of their facial map and voiceprint in digital mediums.
• Review your HR tech: If you use biometric timeclocks (like thumbprint scanners) or facial recognition security cameras on your job sites, clearly document employee consent and outline exactly how that data is stored and destroyed.
• Verify third-party vendors: If you outsource your advertising, require your marketing agency to prove they have secured the rights to every face and voice used in your campaigns, including AI-generated assets.

Follow the Money

When it comes to the state budget, this bill was practically a ghost. According to the nonpartisan Fiscal Note drafted by Legislative Council Staff, the financial impact on Colorado would have been minimal. The legislation did not require any new taxpayer appropriations or large state funding to get off the ground.

To figure out the potential cost, state analysts looked at a comparable existing crime: identity theft with the intent to obtain a thing of value. Between fiscal years 2022 and 2025, exactly 1,439 offenders were convicted of that crime in Colorado. Because HB26-1049 was written so narrowly, analysts assumed there would be very few actual cases filed under this specific new statute. Any slight bump in workload for local district attorneys prosecuting these new Class 4 and Class 5 felonies, or the Judicial Department processing the new civil lawsuits, would easily be absorbed into their existing operational budgets. Criminal fines and civil court filing fees (which are subject to TABOR) might have brought a few extra dollars into state coffers, but nothing that would significantly move the needle on Colorado's bottom line or local county budgets.

Where This Bill Stands

If you were hoping this bill would pass to protect your digital identity, I have bad news. House Bill 26-1049 is officially dead for the 2026 legislative session.

The bill was introduced in the House on January 14, 2026, and assigned to the House Committee on State, Civic, Military, & Veterans Affairs. After hearing witness testimony and discussing the merits on February 2, the committee met again on February 12 and voted to Postpone Indefinitely. In the everyday language of the Capitol, "postponing indefinitely" is the polite, procedural way to kill a piece of legislation. It removes the bill from the calendar permanently for the remainder of the session.

While the exact reasons for its defeat in committee aren't detailed in the status history, bills dealing with the First Amendment, digital privacy, and the creation of new felony classifications often require multiple years of negotiation to get right. Lawmakers often struggle to balance protecting victims with the risk of accidentally criminalizing innocent digital behavior. Expect to see lawmakers take another swing at biometric privacy and deepfakes when the legislature reconvenes in 2027.