Recording Law for Voiceprints & Biometric Data in Colorado

Colorado’s biometric privacy law, effective July 1, 2025, explicitly treats voiceprints as "biometric identifiers." Under Colo. Rev. Stat. § 6-1-1303(2.4)(b), a "voiceprint" is defined as a "biometric identifier." Before a business can collect or process a voiceprint from a customer or employee, it must first obtain that person’s consent meeting the Colorado Privacy Act’s general opt-in consent standard. The law requires the business to clearly explain why it’s collecting the voiceprint and how long it will keep it. For example, if a company uses voiceprints to verify employee identity at building entry points, it must tell employees this upfront and specify the retention period. The law also bars businesses from selling, leasing, or disclosing voiceprints without consent. A written policy outlining retention and deletion rules is mandatory, with deletion required within 24 months of the last interaction or when the purpose for collecting the data ends, whichever comes first.

Colorado’s definition of "biometric identifier" includes "a voiceprint," defined in Colo. Rev. Stat. § 6-1-1303(2.4)(b). The law also carves out a narrow exception: a bare audio recording isn’t considered biometric data unless it’s used for identification purposes. This means a general voice memo or customer service call recording isn’t covered, but a voiceprint used to authenticate someone’s identity is. The law applies regardless of volume thresholds, so even small companies must comply if they use voiceprints for identification.

Before collecting a voiceprint, a business must provide clear notice about what it’s doing and why. The law requires the business to inform the person that a voiceprint is being collected, the specific purpose for collecting it, and how long it will be kept. For example, if a healthcare provider uses voiceprints to verify patient identity during telehealth visits, it must tell patients this before enrollment. The law also requires telling the person if the voiceprint will be shared with a third party, such as a cloud storage provider. Consent meeting the Colorado Privacy Act’s general opt-in standard must be obtained before collection can begin. This is a formal acknowledgment that the person understands and agrees to the collection under the Act’s definition.

Colorado law requires businesses to adopt and publish a written policy for retaining and deleting voiceprints. The policy must specify when voiceprints will be deleted, which must happen within 24 months of the last interaction or when the purpose for collecting the data is satisfied, whichever comes first. The law allows a one-time 45-day extension if the business demonstrates a continued need, but this is not a blank check. For example, a company using voiceprints for customer service authentication must delete the data once the customer’s account is closed, unless there’s a specific, documented need to keep it longer. The policy must be published.

Colorado’s biometric privacy law is enforced exclusively by the Attorney General or district attorneys—there’s no private right of action, so individuals can’t sue for statutory violations. Violations can lead to injunctions, civil penalties, or other enforcement actions by public officials. For example, if a company collects voiceprints without consent or fails to delete them on time, the Attorney General could order it to stop and impose penalties. Enforcement actions are conducted under the statute’s prescribed remedies.

Imagine a Colorado-based tech company that uses voiceprints to authenticate employees when they log into company systems. The company must first obtain consent from each employee meeting the Colorado Privacy Act’s general opt-in standard, explaining that voiceprints are being collected for security purposes and will be kept for 24 months unless the employee leaves the company. The company must publish a retention policy on its website and provide a way for employees to access their voiceprints. If the company later decides to sell the voiceprint data to a third-party vendor, it must get fresh consent from employees meeting the Act’s opt-in standard. If it fails to do any of this, the Attorney General could investigate and take enforcement action.

Colorado law grants consumers the right to access their biometric data, including voiceprints, under Colo. Rev. Stat. § 6-1-1314(5). Businesses must provide a mechanism for individuals to request and receive their stored voiceprint data. This right exists under the statute’s access provision; a correction mechanism is not separately codified in the biometric-specific provisions. The right to access applies to any controller that has collected a consumer’s voiceprint, regardless of the volume of data processed.

Colorado law prohibits businesses from selling, leasing, or disclosing voiceprint data without the person’s consent meeting the Colorado Privacy Act’s general opt-in standard. If a business needs to share voiceprint data with a cloud storage provider, for example, it must inform the person and obtain their consent before doing so. The law also bars discrimination based on biometric data and prohibits certain acts involving biometric identifiers, including voiceprints.