Colorado Is Moving to Ban Warrantless Government Access to Your Location Data

The Bottom Line

If you've ever wondered who has access to your license plate scans or cell phone location data, this bill puts a hard leash on it. It requires police and government agencies to get a warrant before digging into where you've been, blocks them from selling the data, and forces them to delete it after four days.

What This Bill Actually Does

Currently, a vast network of automated license plate readers, cell phone towers, and commercial data systems collect a digital breadcrumb trail of where Coloradans drive and walk. The Protecting Everyone from Excessive Police Surveillance (PEEPS) Act steps in to ensure government agencies can't just browse this data whenever they feel like it. It fundamentally changes the rules of engagement for how the state handles your physical footprint.

Specifically, the bill restricts government access to historical location information—defined as any location data older than 24 hours. If an agency wants to search a database containing photos, facial recognition, cell site data, or license plate logs to see where a person or vehicle has been over time, they will generally need a valid judicial warrant or the person's explicit consent. The bill strictly notes that a standard subpoena is not enough to bypass this rule. Routine toll collection (like Express Lanes), parking enforcement, and life-or-death emergencies are carved out as exceptions, but for investigative snooping, the bar is raised significantly. Interestingly, the bill exempts standard body-worn and dashboard cameras from this rule, provided the footage isn't indexed by facial recognition or biometric identifiers to automatically track movements.

The bill also builds a massive compliance wall around the data. Any government entity collecting this information must encrypt it, require written supervisor sign-off before a search, and keep meticulous logs that get audited every 90 days. Furthermore, the data has a strict expiration date: it must be permanently destroyed after four days, unless a warrant or active criminal investigation specifically requires holding it longer. Finally, agencies must publish an annual public report by June 30th detailing the types and locations of tracking devices they deploy, ensuring residents actually know who is watching.

What It Means for You

For the average Coloradan commuting to work, driving the kids to soccer practice, or attending a local event, this bill is a major privacy upgrade. Right now, every time you drive past an automated license plate reader or a government-run surveillance camera, your location is often logged and stored indefinitely. Under this bill, that everyday tracking gets a strict four-day expiration date, meaning your routine movements won't end up in a permanent, searchable government database just because you drove through a public intersection.

You're also getting new protections against unauthorized data sharing. The bill specifically prohibits your historical location information from being sold to private data brokers or handed over to out-of-state law enforcement agencies. This means out-of-state entities can't easily access Colorado databases to track who visited specific medical clinics, protests, or religious institutions within our state borders. Additionally, to protect your privacy from the general public, this tracking data is officially exempted from the Colorado Open Records Act (CORA), meaning a curious neighbor or private investigator can't simply request your driving history from the city.

If the government does break these rules, the law gives you concrete protections. Any location data pulled illegally becomes inadmissible as evidence in civil or criminal trials. Government officials who access the databases improperly will face mandatory disciplinary action, up to having their database access suspended or revoked. And if your car is ever stolen? You have the power to temporarily waive these privacy rights. The bill specifically allows a registered owner to report a vehicle stolen and voluntarily consent to the police using the database to track it down. While you won't notice a change in how you pay tolls or get parking tickets, you can drive easier knowing the digital footprint of your daily life is heavily guarded.

What It Means for Your Business

If you own a private business that deals in data brokering, security, or government software contracting, this legislation will fundamentally rewrite how you interact with public agencies. Colorado government entities will be strictly prohibited from selling or conveying historical location information to private, nongovernmental third parties for any reason. If your business model relies on purchasing, licensing, or scraping location data (like license plate scans) from local municipalities or state agencies, that data pipeline will be completely shut off.

For technology vendors and IT service providers who build or maintain these tracking systems for the government, the compliance requirements are getting incredibly tight. While there is a narrow exception allowing third-party vendors to access this data to fix software bugs or technical malfunctions, the access must be temporary and limited to the absolute minimum time required. You will be explicitly prohibited from aggregating, copying, or analyzing the data for your own purposes, and you must immediately delete all access once the support ticket is closed. Expect your municipal and state contracts to be heavily updated to reflect these strict auditing, encryption, and deletion requirements.

However, there is a silver lining for the cybersecurity, data management, and IT compliance sectors. Because the bill mandates that all location data be encrypted using industry-accepted methodologies and requires governments to conduct routine 90-day audits of all access logs, local governments are going to need help. Municipalities, sheriff's departments, and state agencies will likely need to procure new software solutions or hire consultants to build out these compliant tracking and auditing systems. If you operate in the GovTech space, this creates a strong, durable market for building privacy-first infrastructure that automatically purges data after the mandatory four-day retention window.

Follow the Money

According to the nonpartisan fiscal note, this bill will have a surprisingly minimal impact on the state budget. The Colorado Bureau of Investigation (CBI) and the Judicial Department will see increased workloads to handle the new warrant reviews, records redactions, and 90-day compliance audits, but the state expects to absorb these costs using their existing resources and personnel. Because of this, no new state appropriations or taxpayer funding are required to implement the law at the state level.

The financial burden will primarily land on local governments. City police departments, county sheriffs, and municipal agencies that currently use automated license plate readers or other tracking databases will have to bear the cost of upgrading their data systems to ensure strict compliance. This means local taxpayer dollars will likely be spent on new encryption software, building mandatory auditing policies, and dedicating staff hours to manually review access logs and purge data every four days to stay on the right side of the law.

Where This Bill Stands

SB26-070 is currently In Committee. The latest official action came on 04/29/2026: Senate Second Reading Laid Over to 07/04/2026 - No Amendments.

That means the bill is still in the committee stage, and it is currently sitting in the Judiciary. To keep moving, it would need to clear committee and then survive floor votes in both chambers.