Colorado, Michigan Advance Child and Consumer Data Privacy Laws
Colorado and Michigan have advanced major bills expanding online privacy protections for children and consumers.
Why it matters: Compliance teams and legal departments must navigate an evolving patchwork of state data privacy requirements. These new laws increase companies’ risk exposure and prompt review of data management practices, especially for platforms serving minors.
- Colorado House passed SB26-051, requiring age attestation on device accounts, on April 30, 2026.
- SB26-051 mandates operating systems create an age 'signal' for app developers and restricts data sharing.
- Michigan Senate passed the 'Kids Over Clicks' package on April 29, 2026, targeting child online privacy.
- Michigan’s legislation bans targeted ads to children and requires parental consent for minors on social media.
The privacy landscape for technology platforms and corporate legal teams is shifting following recent legislative actions in Colorado and Michigan.
- On April 30, 2026, Colorado’s House approved Senate Bill 26-051 ("Age Attestation on Computing Devices") with a 40-23 vote.
- SB26-051 requires operating system providers to prompt for a user's birth date or age during account setup, generating an “age signal” shared with downloaded apps. Developers must request and use this signal but cannot share it with third parties beyond bill requirements.
- Civil penalties for noncompliance could reach $2,500 per minor (negligent) or $7,500 per minor (intentional).
Michigan, meanwhile, is moving ahead with its own comprehensive children’s privacy reform. On April 29, 2026, the state Senate cleared the "Kids Over Clicks" package (Senate Bills 757-760):
- Children will be prohibited from using social media platforms without parental consent.
- Targeted advertising directed at minors will be banned, and AI-powered chatbots available to children are further restricted.
- Platforms must minimize data storage and empower parents with enhanced privacy controls.
- Fines for violations range from $5,000 to $50,000. AI companies are liable for harms to children caused by their chatbots.
Lawmakers driving the Michigan bill positioned it as a direct response to the harms of "big tech" profiting from children, emphasizing a zero-tolerance approach. Still, the legislative texts’ relationship to federal law (such as COPPA) and specific compliance timelines remain to be clarified.
By the numbers:
- 40-23 — Colorado House vote approving SB26-051
- $2,500 to $7,500 — Civil penalty per minor for SB26-051 violations
- $5,000 to $50,000 — Possible fines for violating Michigan's Kids Over Clicks laws
Yes, but: Implementation timelines and interactions with federal law are not yet detailed.