Colorado’s latest attempt to regulate minors’ online access differs from its predecessors. Senate Bill 26-051 doesn’t target adult websites directly. Instead, it targets the operating system sitting on your phone.
The bill, currently before the Senate Committee on Business, Labor, and Technology with a hearing scheduled for February 24, would require operating system providers to collect your date of birth when you create an account.
We obtained a copy of the bill for you here.
That data gets converted into an age bracket signal, which then flows to app developers through an API whenever you download or open an app. Developers must request and use that signal. The age check becomes embedded in the infrastructure before you ever reach the app itself.
Reclaim Your Digital Freedom.
Get unfiltered coverage of surveillance, censorship, and the technology threatening your civil liberties.
This is a structural change from what Colorado has tried before. SB 25-201, passed out of committee in 2025 but ultimately lost, required websites hosting material deemed harmful to children to run their own age verification. It also mandated at least one verification method that didn’t expose a user’s identity, and required compliance with Colorado’s Privacy Act data handling standards.
Those provisions didn’t save it. Civil liberties groups argued that requiring government ID to access lawful speech burdens adults. Technical experts pointed out that a state mandate can’t easily reach websites hosted outside Colorado. The bill went nowhere.
Senate Bill 25-086 tried platform-level requirements instead, making social media companies determine user age categories and redesign accordingly. Governor Jared Polis vetoed it in April 2025, citing feasibility problems, constitutional exposure, and the difficulty of imposing broad mandates on platforms at the state level.
SB 26-051 exists because of those failures. By moving enforcement to the operating system layer, lawmakers are targeting a genuine chokepoint. Apple and Google control the operating systems, app stores, account infrastructure, and software distribution pipelines for virtually every smartphone. Requiring age signals at that layer means a defined compliance target with a limited number of companies to regulate.
The desktop web doesn’t offer that. Browser-based access spans millions of independently operated sites across multiple jurisdictions. There’s no single point of control. Any law that tried to impose universal age verification across the open web would require something far more radical, either mandatory identity verification for internet access, which would end anonymous browsing entirely, or rely on parental controls, which already exist and remain optional.
That reality shapes the bill’s most honest framing: it imposes heavy compliance burdens on operating system providers and app developers while leaving the broader ecosystem largely unchanged.
Apple and Google would be required to collect age data, generate signals, and build API infrastructure, cementing Big Tech dominance.
App developers would be required to integrate those signals into their applications. Users would be required to provide their date of birth information when establishing accounts.
The constitutional terrain here is unstable, thankfully. Federal courts reviewing age verification laws in other states have scrutinized whether such laws are narrowly tailored and whether less restrictive alternatives exist. Parental controls are exactly that alternative. Major platforms already offer device-level and account-level filtering tools that parents can configure voluntarily. Courts have noticed.
