1. (1) Except as described in subsection (2) of this section, a school district or a school or a charter school of a school district shall not execute a contract with any vendor for the purchase of, or for services related to, any facial recognition service.

2. (2) The prohibition described in subsection (1) of this section does not apply to:

   1. (a) A contract in effect on April 18, 2025;
   2. (b) A contract for the purchase of, or for services related to, a generally available consumer product, including a tablet or smartphone, that allows for the analysis of facial features in order to facilitate the user's ability to manage an address book or still or video images for personal or household use;
   3. (c) A contract with a school service contract provider, as defined in section 22-16-103 (8), for the purchase of a product, device, or software application that allows for analysis of facial features for educational purposes in conjunction with curricula approved by the local school board of a school district, as defined in section 22-5-103 (4); or

   4. (d) A contract with a school service contract provider, as defined in section 22-16-103 (8), for the purchase of a product, device, or software application that allows for the analysis of facial features under the following circumstances:

      1. (I) A school official or law enforcement officer makes a determination that an individual whose facial imaging has been obtained has made an articulable and significant threat against a school or the occupants of a school, and the use of facial recognition technology may assist in keeping the school and occupants safe;
      2. (II) A student absconds from a school class, event, or program or is otherwise reported as lost or missing by students, parents, teachers, or school officials, and there is a reasonable belief that using facial recognition technology may assist in finding the lost student based on data that could indicate the student's presence, location, or movements within or around school grounds; or
      3. (III) An individual has been ordered by the court or by the school administration to stay off school district property, and, based on threatening or harassing behavior, as determined by a school official or law enforcement officer, there is a reasonable belief that the individual may attempt to reenter district property in the future.

      4. (2.5)

         1. (a)

            1. (I) If a school has a contract to use facial recognition services pursuant to the exemption in subsection (2)(c) of this section, the school or contractor shall not process:

               1. (A) A student's biometric identifier without first obtaining the student's consent and the consent of the student's parent or legal guardian on the form described in subsection (2.5)(a)(II) of this section; except that, if the student is in fifth grade or below, only the consent of the student's parent or legal guardian is required;
               2. (B) A staff member's biometric identifier without first obtaining the staff member's consent on the form described in subsection (2.5)(a)(II) of this section; or
               3. (C) Any other individual's biometric identifier without first obtaining the individual's consent and the consent of the individual's parent or legal guardian if legally required on the form described in subsection (2.5)(a)(II) of this section.

            2. (II) The consent form must:

               1. (A) Be opt-in;
               2. (B) Be stand-alone from other information and waivers;
               3. (C) Include a notice that a biometric identifier is being collected, what the biometric identifier will be used for, and who will be in control of the biometric identifier; and
               4. (D) Include information about the retention schedule of the biometric identifier.
            3. (III) Consent may be obtained either at the beginning of each school year, to cover use of all curriculum that collects a biometric identifier or biometric identifiers, or prior to use of the curriculum that collects a biometric identifier or biometric identifiers.

         2. (b)

            1. (I) If a school has a contract to use facial recognition services pursuant to the exemption in subsection (2)(d) of this section, the school shall provide notice to all students, parents and legal guardians, and staff, and shall post notices at the entrances to school grounds that individuals may be subject to use of facial recognition services on school grounds.
            2. (II) If facial recognition services are being used for any of the circumstances pursuant to subsection (2)(d) of this section, the facial recognition services must only be used to identify and locate the specific individual or individuals for the exempted circumstance and to identify and locate a specific individual or individuals whom there is reasonable belief were connected to the exempted circumstance.
            3. (III) If facial recognition services are being used for any of the circumstances pursuant to subsection (2)(d) of this section, the facial recognition services, once enabled, must not be used for any other purpose during that time frame and must be disabled immediately upon identification and determining the location of the individual or individuals in the exempted circumstance; except that, if the technology of the school contractor is not able to be enabled or disabled without decreasing the effectiveness of the technology, a school district that utilizes facial recognition technology through security cameras may maintain the system in an operational state at all times, but the system must not be used to actively or passively identify any individuals unless one or more of the circumstances described in subsection (2)(d) of this section is actively occurring.
            4. (IV) In circumstances described in subsection (2)(d)(II) of this section, if the student has been determined to no longer be on the school grounds, the facial recognition services must be disabled once the location of the student who exited the school grounds has been determined or the last known location of the student on school grounds has been determined.
            5. (V) Each school district shall develop a policy governing the use of facial recognition technology, including clear guidelines on access and oversight. The policy must designate specific authorized personnel, such as school administrators and law enforcement officials, who are permitted to process facial recognition data in response to an articulable and significant threat against the school. No other individuals have access to or are allowed to utilize the facial recognition data. Facial recognition searches may only be conducted through a formal request process, ensuring appropriate oversight and adherence to security protocols while maintaining the system's readiness for emergencies.
         3. (c) A school or school contractor in possession of biometric identifiers shall not retain each individual's biometric identifier for longer than eighteen months.
         4. (d) Whenever an aggrieved party or counsel of an aggrieved party has cause to believe that a school, employee of a school, or contractor of a school has engaged in or is engaging in a practice that violates this section, the aggrieved party may apply for, in an action in the appropriate district court of this state, a temporary restraining order or injunction, or both, pursuant to the Colorado rules of civil procedure, prohibiting the school, an employee of the school, or a contractor of the school from continuing the practices or doing any act in furtherance of a violation of this section. The court may enter orders or judgments as necessary to prevent the use or employment of the prohibited practice, to restore any person injured to their original position, or to prevent any unjust enrichment by any person through the use or employment of any violation.
3. (3) As used in this section, facial recognition service has the meaning set forth in section 24-18-301 (5).
4. (4) Repealed.

Source: L. 2022: Entire section added, (SB 22-113), ch. 463, p. 3293, § 5, effective August 10. L. 2025: (2)(a) amended, (2)(c), (2)(d), and (2.5) added, and (4) repealed, (SB 25-143), ch. 86, p. 357, § 1, effective April 18.