Colorado moves to regulate FRT in schools with groundbreaking legislation

Legislation that aims to protect the biometric data of Colorado school students and staff was passed by the Colorado General Assembly in a decisive 63-2 bipartisan vote. The bill sets new standards for how biometric data – particularly facial recognition – is used in the state’s educational institutions. Co-sponsored by Democratic Rep. Michael Carter and Republican Rep. Ryan Armagost, the bill awaits Governor Jared Polis’ signature. Once it’s law, Colorado will codify one of the most comprehensive state-level frameworks for the use of facial recognition in K-12 education.

The legislation represents a balance between protecting the privacy of students and staff and ensuring that schools can continue using certain advanced technologies for safety and security. Colorado is the only state with specific statutory restrictions governing the use of facial recognition technology in schools.

“Technology is advancing quickly, and it’s important that we uphold the privacy of our students and staff,” Carter said in a statement. “While facial recognition technology can be helpful for schools in certain safety scenarios, such as locating a missing student, any biometric data that is collected must be stored securely. The passage of this bipartisan bill helps protect our students and staff, making sure their biometric data is not shared freely.”

At the heart of SB25-143 is a commitment to data privacy. The legislation extends the state’s existing restrictions on facial recognition systems in schools which were originally set to expire in July 2025. Without the legislation, schools would have been permitted to deploy such systems without clear guidelines or consent requirements after that date. The new measure not only maintains these protections, but it also expands and clarifies them in significant ways.

The bill mandates that any collection or processing of biometric identifiers must be done only with explicit, informed consent. In the case of students, both the student and their parent or guardian must consent to the use of facial recognition. For younger children in fifth grade or below, only the consent of the parent or guardian is required. Staff members must also give direct consent before any biometric data pertaining to them can be processed.

Transparency is another cornerstone of the legislation. SB25-143 requires school districts to provide clear and timely notice to students, parents, and staff when facial recognition systems are in use. This transparency must be supported by well-defined policies adopted by school districts or charter schools. These policies are required to specify exactly how the technology will be deployed, who is authorized to access it, and under what circumstances.

Only designated personnel such as school administrators or law enforcement officials are permitted to access the biometric data, and their access is limited to cases involving clearly defined safety threats. These threats include identifying individuals who have made threats of violence against a school, locating missing children on or around school grounds, and alerting staff to persons legally prohibited from entering school property due to court orders or district decisions.

Importantly, the bill allows schools to use facial recognition technology under an opt-in model for limited, board-approved educational and safety purposes. This provision emerged after substantial input from educators and security professionals who argued that a complete ban, as originally proposed, would have undermined important safety capabilities already in place.

The original version of the bill proposed a full ban on the use of facial recognition technology in K-12 schools, a move that was quickly met with resistance from the Colorado education community. School districts pushed back during the legislative process by urging lawmakers to reconsider. Citing their longstanding and successful use of the technology as an additional layer of student safety, school officials emphasized its value in specific, limited scenarios.

Throughout 2023 and 2024, representatives from various districts shared detailed insights with the Colorado General Assembly’s Task Force for the Consideration of Facial Recognition Services, stressing the importance of allowing its use in carefully defined situations. One of the representatives said the technology was used to prevent a special needs student from wandering off campus unsupervised, a potentially life-threatening scenario that was averted due to the system’s alerts. These kinds of real-world applications helped shift the conversation around the bill, moving it from a strict ban to a more nuanced, safety-conscious regulatory framework.

SB25-143 doesn’t leave school districts unchecked, however. The bill imposes clear limitations on how biometric data is handled and requires that any such data be deleted within 18 months of collection. The legislation also explicitly prohibits unauthorized sharing or secondary use of the data. Further, those who believe their biometric data rights have been violated are empowered to seek legal remedies, including temporary restraining orders or injunctions, to prevent misuse or unauthorized access.

Privacy advocacy organizations such as the American Civil Liberties Union of Colorado and the Colorado Education Association praised the measure for balancing innovation with accountability. The two groups pointed to growing concerns nationwide over the unchecked deployment of surveillance technologies in public institutions and lauded SB25-143 for establishing guardrails that protect individual privacy rights without sacrificing school safety.

The Security Industry Association (SIA) which had initially expressed concern over the bill’s original, more restrictive language, also supported the final version. SIA noted that the revised bill enables schools to maintain facial recognition systems in an operational state so long as the systems are only used in compliance with the specific safety scenarios outlined in the law. SIA applauded its inclusion on the state’s Facial Recognition Task Force that allowed industry voices to contribute subject matter expertise to future policymaking.

“It is essential that we ensure our school security professionals can responsibly leverage such technologies to best protect students, teachers and staff using proven best practices,” said Jake Parker, SIA’s senior director of government relations.

Other educational leadership groups, including the Colorado Association of Superintendents and School Administrators, the Colorado Association of School Executives, and the Colorado Association of School Boards, also rallied behind the amended bill. These organizations spent the better part of two years engaging with lawmakers, offering testimony and technical input, and pressing for a framework that allowed facial recognition technology to be used responsibly.

SB25-143 also aligns with existing data protection laws, including Colorado’s Student Data Transparency and Security Act and the federal Family Educational Rights and Privacy Act.

Article Topics

biometrics  |  Colorado  |  data protection  |  facial recognition  |  legislation  |  school security  |  schools  |  Security Industry Association (SIA)  |  United States