Your Face, Your Voice, and Deepfakes: What Happened to Colorado's Biometric Privacy Bill?

The Bottom Line

If someone uses your face, voice, or fingerprint in a video, deepfake, or ad without your permission, this bill makes it a felony and lets you sue them for damages. It's Colorado's attempt to crack down on malicious AI cloning and biometric theft, while carving out protections for news, parody, and law enforcement.

What This Bill Actually Does

The rapid rise of artificial intelligence has made it incredibly easy to clone a voice or map a face. Right now, if someone uses an AI tool to make it sound like you are saying something you never actually said, or splices your face into a synthetic video, the law is a bit muddy. HB26-1049 aims to clear that up by creating a brand-new section of the criminal code (Section 18-5-906): the unlawful use of a personally identifying feature. Under this proposal, taking someone's biometric data and putting it into a digital format without permission becomes a Class 5 felony.

The bill is very specific about what counts as a personally identifying feature. It protects your fingerprints, voiceprints, retina or iris scans, and your facial map, facial geometry, or facial template. If someone takes these features and uses them to create an advertisement, a deepfake, an image, a video, a voice recording, or any other digital depiction without your explicit green light, they have broken the law. Furthermore, if they do this with the specific intent to cause you physical, emotional, or financial harm—think of revenge porn, scamming a relative with a cloned voice, or sabotaging a career—the crime is elevated to a more serious Class 4 felony. Importantly, the bill also establishes a civil cause of action, meaning victims can hire a lawyer and sue the creator for damages and attorney fees just by proving the unauthorized use occurred.

Because a blanket ban on taking pictures or recording voices would create absolute chaos in public spaces, the legislation carves out several significant exceptions. The rules do not apply to:

• Law enforcement and government workers performing their official duties, or regular citizens documenting a crime in progress.
• News, sports broadcasts, and public affairs programming.
• Satire, parody, scholarship, or criticism (so late-night TV, comedians, and documentary filmmakers are safe).
• Fleeting or incidental use, like someone accidentally walking through the background of a vlog or tourist photo.

Essentially, if the activity is protected by the First Amendment, it remains exempt. The real target here is deceptive, unauthorized digital replication meant to exploit or harm everyday people.

What It Means for You

For the average Coloradan, this bill acts as a major digital shield, especially against the rising tide of AI-driven scams and digital harassment. We have all heard the modern horror stories: a grandparent gets a frantic phone call that sounds exactly like their grandchild begging for bail money, only to find out the voice was cloned from a public social media video. Under this legislation, the act of creating that voiceprint clone with the intent to cause financial harm is a Class 4 felony. It gives local prosecutors a much sharper, highly specific tool to go after digital fraudsters who weaponize your likeness against you or your family.

Beyond the criminal penalties, this bill gives you immense personal leverage. If a company uses your facial map or voice in an ad without paying you or asking permission, you do not have to wait around for the district attorney to care. The bill explicitly states that unauthorized use is a "legally cognizable harm." This is a crucial legal phrase—it means you do not necessarily have to prove you lost a specific amount of money to sue them. You just have to prove they used your likeness without permission. You have the right to take them to civil court, claim any amount of damages, and force them to pay your reasonable attorney fees if you win. It puts the ownership of your digital identity firmly back in your hands.

While the protections are strong, you will want to be mindful of the gray areas—specifically around the satire and parody exceptions. If someone makes a mocking deepfake of you that is clearly intended as a joke or political commentary, it might be protected First Amendment speech rather than a felony. To protect yourself going forward, keep a close eye on your digital footprint. If you ever find yourself the victim of unauthorized digital cloning, document everything immediately—take screenshots, save URLs, and download the audio. This bill ensures that you have both a police report to file and a civil lawsuit to pursue.

What It Means for Your Business

If you run a business in Colorado, particularly if you handle marketing, media, tech, or content creation, this bill requires an incredibly tight grip on how you source your creative assets. Using someone's personally identifying feature in an advertisement or digital depiction without explicit permission creates a massive liability under this proposal. If your marketing agency uses an AI tool that happens to generate a likeness based on a real person's facial template, or if you use an AI voiceover that closely mimics a specific, identifiable individual without a signed release, you could be facing both an expensive civil lawsuit and serious criminal charges. Ignorance of the AI's source material might not save you.

The safest move here is to immediately audit your company's media releases and independent contractor agreements. If you feature employees, customers, or vendors in your promotional videos, podcasts, or social media campaigns, you need to ensure your standard waivers explicitly grant permission to capture, manipulate, and use their voiceprints and facial geometry. Handshake agreements, implied consent, or generic photo releases from ten years ago won't hold up if a dispute arises over a new digital campaign. You will want your legal counsel to update your standard release forms to cover modern digital depictions and AI-generated adaptations so your business is completely insulated from claims of unauthorized use.

For businesses in the media, journalism, or software development spaces, you must carefully navigate the boundaries of the bill's exemptions. If you run a local news site, a sports blog, or a review channel, you are largely protected under the news, public affairs, and criticism exceptions. However, if you are developing software that utilizes biometric security—like retina or fingerprint scanning for employee building access—you must guarantee that this data is securely siloed and never inadvertently used or sold for secondary digital depictions. Any commercial announcement for a protected audiovisual work is fine, but the line between a protected documentary and an unlawful commercial deepfake can get blurry. Implementing clear, written consent protocols across your entire operation is your best defense.

Follow the Money

You might expect a brand-new felony category to cost the state millions of dollars in prison beds, investigative resources, and court time, but the nonpartisan fiscal note suggests the financial impact of HB26-1049 will actually be minimal. Why? Because district attorneys already prosecute similar crimes using existing statutes—most notably, identity theft with the intent to obtain a thing of value. Over the last three fiscal years, Colorado has seen roughly 1,400 convictions under that existing identity theft umbrella.

The state assumes that district attorneys will use this new law as an additional charging tool in cases they are already pursuing, rather than it triggering a massive, unprecedented wave of brand-new investigations that overwhelm the system. Any slight increase in state revenue from criminal fines or civil court filing fees (which are subject to TABOR limits) is expected to be negligible. Because of this, the bill does not require a tax hike or a specific new state appropriation to enforce. Local governments, county courts, and county jails shouldn't see a noticeable bump in their operating costs, either.

Where This Bill Stands

HB26-1049 is currently Dead. The latest official action came on 02/12/2026: House Committee on State, Civic, Military, & Veterans Affairs Postpone Indefinitely.

That means the bill is no longer advancing this session. In practice, measures that are postponed indefinitely or otherwise declared lost generally stay dead unless they are reintroduced in a future session.