4 Colo. Code Regs. § 904-3-6.12

Current through Register Vol. 48, No. 1, January 10, 2025

Section 4 CCR 904-3-6.12 - [Effective 1/30/2025] BIOMETRIC IDENTIFIER NOTICE

A. Controllers required to provide a Biometric Identifier Notice shall comply with all requirements for disclosures and communications to Consumers provided in 4 CCR 904-3, Rule 3.02.

B. The Biometric Identifier Notice shall occur at or before the initial collection or Processing of any Biometric Identifiers, or before a material change to the Processing purpose of a Biometric Identifier.

C. A Biometric Identifier Notice must be clear. Information contained in such notice shall be:

1. Concrete and definitive, avoiding abstract or ambivalent terms that may lead to varying interpretations.

2. If included in a privacy notice, clearly labeled, such that Consumers seeking to understand a Controller's collection and use of Biometric Identifiers can easily access the section of the privacy notice containing relevant information.

D. A Biometric Identifier Notice must be reasonably accessible. Such notice may be:

1. A separate notice, or included within a general privacy notice if the privacy notice is clearly labeled as required by 4 CCR 904-3, Rule 6.12(C)(2); and

2. Made available in its entirety prior to the collection or Processing of Biometric Identifiers, or linked from a website's homepage, and if applicable, a mobile application's app store page or download page.

a. A link made available on the homepage of a website or on a mobile application's app store page or download page must be conspicuous and must clearly indicate it relates to Biometric Identifiers in the link text. A Controller that Processes Biometric Identifiers and maintains an application on a mobile or other device shall also include a link to the Biometric Identifier Notice in the application's settings menu.

b. If the link directs to a privacy notice, it must point the Consumer to the specific section of the privacy notice that includes the Biometric Identifier Notice disclosures.

E. A Controller that does not operate a website shall make the Biometric Identifier Notice conspicuously available to Consumers through a medium regularly used by the Controller to interact with Consumers. For instance, if a Controller interacts with a Consumer offline, an offline version of the privacy notice must be available to the Consumer.

4 CCR 904-3-6.12

48 CR 01, January 10, 2025, effective 1/30/2025