Colorado Is Moving to Ban Warrantless Government Access to Your Location Data

What This Bill Actually Does

Right now, government entities can essentially bypass the traditional warrant process by purchasing massive troves of location data from private commercial data brokers. SB26-070, also known as the PEEPS Act (Protecting Everyone from Excessive Police Surveillance Act), shuts that pathway down. Under a new Section 16-3-313, the bill strictly prohibits any Colorado government official from accessing public or private databases that reveal an individual's or a vehicle's historical location information—defined as location data older than 24 hours. This covers everything from cell tower pings and facial recognition hits to automated license plate readers.

The bill isn't a blanket ban; it features several practical exceptions. Police can still access the data if they secure a valid judicial warrant (and the legislation explicitly notes that a basic subpoena doesn't count). They can also access the information if there are exigent circumstances (like an active kidnapping), if an individual gives express consent, or if you report your car stolen and ask them to track it. Furthermore, the bill carves out daily operational needs: toll collection, parking enforcement, and automated traffic cameras are exempt. However, the default rule flips from "accessible" to "off-limits."

If an agency does collect this data legally, the compliance rules are incredibly strict. Agencies must permanently destroy the data within four days, unless a judge signs off on a longer period or it is actively being used to preserve evidence in a criminal investigation. Agencies are required to audit their database access every 90 days, encrypt the data, require written supervisor approval for every single search, and publish an annual transparency report every June 30. Most importantly, if police use location data in violation of this law, the evidence becomes completely inadmissible in a Colorado court, and the offending officer faces mandatory disciplinary action.

What It Means for You

For the average Coloradan, this represents a major upgrade to your digital privacy rights. Whether you are commuting to work, dropping kids off at school, or going to a medical appointment, your physical movements leave a massive digital exhaust trail. Right now, there is a legal gray area allowing government entities to piece together your habits and associations without probable cause. This bill draws a hard line: your location history is none of the state's business unless a judge explicitly agrees there is a valid reason to look.

You will also see stricter protections regarding how dash-cam and body-cam footage is used. While the bill excludes standard government security cameras from the ban, it specifically states that if the government runs that footage through facial recognition or biometric software to track your historical movements, it triggers the warrant requirement. On the flip side, if your car is stolen, the law won't tie your hands—you can still voluntarily authorize the police to ping its location history. They just cannot use your consent as a loophole to snoop on anyone else's data.

• Watch the Judiciary Committee calendar: If digital privacy is a priority for you, right now is the time to submit written testimony to the Senate Judiciary Committee.
• Check your local police department's current policies: Ask your city council if local law enforcement currently purchases commercially available location data. This will tell you exactly how much of a shift this bill represents for your specific community.

What It Means for Your Business

If your business revolves around data brokering, software development, or selling surveillance technology to local governments, SB26-070 requires your immediate attention. The bill expressly prohibits government agencies from selling or conveying historical location data to private third parties. There is a very narrow exception allowing a nongovernmental third-party vendor to temporarily access the data to fix a software bug or maintain a system. However, as a vendor, you must delete that data immediately once the repair is complete—you absolutely cannot retain, analyze, or aggregate it for any secondary commercial purpose.

For businesses that contract with the state fleet—or if you rely on the Department of Personnel and Administration (DPA)—expect major logistical changes. The state manages about 5,550 vehicles that generate location data, and they will need to completely overhaul their tracking systems to comply with the bill's four-day data destruction rule. Additionally, if your company builds compliance or auditing software, there is a lucrative opportunity here. Government agencies across the state will need new, encrypted software solutions to handle the mandatory 90-day supervisor audits, automated data purging, and redaction of personally identifiable information.

• Review your government contracts: If you provide IT, data storage, or fleet tracking services to a Colorado municipality or state agency, review your data retention capabilities to ensure your software can support the strict four-day deletion mandate.
• Prep your tech support protocols: If you are a third-party vendor who occasionally needs database access for troubleshooting, start drafting legal agreements now that strictly limit your access to maintenance-only, as required by the new law.

Follow the Money

Privacy doesn't come cheap. The official fiscal note projects this bill will cost the state nearly $2 million in FY 2026-27 and about $1.5 million annually after that, funded directly by the General Fund. The biggest chunk—$1.2 million—goes to the Judicial Department to handle an estimated 1,550 new warrant requests and over 9,000 new hearings and records-related motions, which will require hiring 5.4 new full-time employees, including new judicial officers.

Other departments will also see budget bumps. The Colorado Bureau of Investigation (CBI) needs roughly $348,000 for new compliance staff and software to manually screen records and log supervisor approvals. Meanwhile, the state fleet program requires $434,000 (including a $200,000 private contractor fee) to overhaul its vehicle tracking systems to stay legal. Here is the one massive caveat to watch: The Judicial Department initially warned this bill could cost them $64 million if the law accidentally applies to their internal case management and reporting systems. The fiscal analysts currently assume lawmakers will amend the bill to exempt court software, but if that amendment doesn't happen, the price tag will explode.

Where This Bill Stands

SB26-070 was officially introduced in the Senate on January 28, 2026, and has been assigned to the Senate Judiciary Committee. It features a robust list of sponsors, spearheaded by Senators Judy Amabile and Lynda Zamora Wilson, alongside Representatives Yara Zokaie and Kenny Nguyen in the House.

The immediate hurdle for this bill is the fiscal note. The Judiciary Committee will need to clarify the language around court software to avoid that $64 million landmine identified by the Judicial Department. If they can patch that up with an amendment and secure the $2 million from the General Fund, expect this to move forward steadily, as privacy protections tend to draw interesting bipartisan coalitions. If passed, the law takes effect August 12, 2026 (90 days after the session ends), applying to any violations that occur after that date.