Video Surveillance Laws in Colorado: A Compliance Reference for Security Teams

Colorado video surveillance compliance turns on where each camera points, what it captures, and which statutes and privacy doctrines apply to that specific deployment. A single misconfigured camera, whether pointed into a private space or running unnecessary audio, can expose a facilities manager or PSOC operator to criminal charges and civil liability.

Key Takeaways

• Colorado surveillance compliance depends on where a camera points and whether it captures audio or runs biometric analytics.
• Silent video in public and operational areas carries minimal legal exposure, while cameras aimed into restrooms, locker rooms, or dressing rooms can trigger criminal charges.
• Cameras with active microphones raise separate one-party consent and business-premises notice issues; disabling unnecessary audio is the lower-risk configuration.
• Adding biometric analytics to an existing camera system creates written-policy and consent duties. It also adds deletion obligations even when the video itself is already lawful.

Core Statutory Framework and Reasonable Expectation of Privacy

Several Colorado criminal provisions and a civil privacy tort shape surveillance compliance. C.R.S. § 18-7-801, criminal invasion of privacy, prohibits knowingly observing or photographing another person's intimate parts without consent where a reasonable expectation of privacy exists. Its broad definition of "photograph" reaches all CCTV and IP camera systems.

A parallel statute, C.R.S. § 18-3-405.6, criminalizes the same conduct when motivated by sexual gratification and carries steeper penalties. Camera microphones fall under separate wiretapping and eavesdropping provisions in C.R.S. §§ 18-9-303 and 18-9-304.

Colorado also recognizes the tort of intrusion upon seclusion. The tort requires an intentional invasion of privacy that a reasonable person would find highly offensive, and this civil exposure runs in parallel to criminal liability.

Video Versus Audio Recording Rules

Colorado treats video-only recording and camera microphone capture under different regimes. For video surveillance teams, audio review should start with microphone status and the consent or notice basis for any capture. Teams should also decide whether the organization can disable audio without affecting the security use case.

Video-Only Systems

Video-only surveillance is treated permissively. Eavesdropping-statute consent and notice duties apply to audio, while silent-camera compliance turns entirely on location, meaning the reasonable expectation of privacy analysis, rather than on consent. Security teams should audit fields of view to confirm that silent cameras cover public and operational areas and avoid spaces where privacy is expected.

Audio Consent

Colorado is a one-party consent state for in-person conversations and telephone or electronic communications under §§ 18-9-304 and 18-9-303. For camera deployments, an active microphone needs a separate consent or notice basis; a silent camera generally does not. Where microphones are not needed, disabling audio remains the lower-risk configuration.

The business-premises exception can reduce this exposure when its notice requirement is met. C.R.S. § 18-9-305 permits audio surveillance on one's own premises for security or business purposes, provided reasonable notice of the devices is given to the public. Security teams should review microphone status and posted notices together so the site notice program matches the system configuration.

Where Surveillance Is Permitted and Prohibited

Colorado camera placement divides along the reasonable expectation of privacy line. Permitted zones carry minimal exposure. Prohibited zones escalate to criminal charges and, in some cases, mandatory sex offender registration. For mixed-use sites, apply the strictest rule to each specific camera zone.

Permitted locations include public streets and plazas, retail sales floors, building entrances and lobbies, parking lots, and operational spaces such as loading docks and warehouses. None carries a reasonable expectation of privacy.

Restrooms, locker rooms, and changing or dressing rooms fall under §§ 18-7-801 and 18-3-405.6, carrying criminal exposure. Bedrooms and sleeping areas in residential contexts are similarly off-limits. Private offices with an expectation of seclusion can generate civil liability under the intrusion upon seclusion tort even where no criminal statute applies.

Workplace Surveillance Laws in Colorado

Colorado employer video monitoring obligations derive from the criminal privacy statutes and common law privacy torts already discussed.

For workplace cameras with active microphones, employers should pair any lawful microphone use with written employee notice. Employers cannot monitor employees on personal devices without consent.

Recent legislation adds compliance layers. Under Colorado’s AI Act (SB24-205), with implementation delayed to June 30, 2026, employers using covered AI systems for employment-related consequential decisions must provide notice about the system, its purpose, and the nature of the decision, with additional disclosures in some circumstances about the data used. The notice must also explain the role the AI system played in the decision. HB 24-1130, effective July 1, 2025, lets employers condition employment on biometric data collection without prior opt-in only for narrow purposes such as securing physical locations, timekeeping, and workplace safety. All other biometric uses require affirmative opt-in consent; opt-out consent is invalid.

Notice and Signage Requirements

For silent cameras in public places, Colorado’s general audio recording rule is found at Colo. Rev. Stat. § 18-9-303, while § 18-7-801 addresses criminal invasion of privacy involving photographing a person’s intimate parts without consent.

For cameras with active microphones, posted notice at building or area entry points preserves the business-premises exception when microphones are in use in public or common areas. Even where not legally required, prominent signage is advisable to inform employees and visitors that cameras are in use and provide a complaint contact. The same notice can explain what data is captured and retained.

Data Privacy, Retention, and Biometric Obligations

Biometric Processing Duties

The Colorado Privacy Act, C.R.S. §§ 6-1-1301 to 6-1-1314, took effect July 1, 2023, and applies to controllers processing personal data of 100,000 or more consumers annually, or controllers that derive revenue or receive a discount from the sale of personal data and process or control personal data of 25,000 or more consumers, with coverage for controllers processing any amount of biometric identifiers or biometric data effective July 1, 2025. Biometric and genetic data qualify as sensitive data requiring opt-in consent before collection.

HB 24-1130 amended the CPA to add additional biometric requirements and authorized the attorney general to promulgate implementing rules. A biometric identifier includes fingerprints, voiceprints, iris scans, and facial maps or templates.

For CCTV operators, raw video footage remains ordinary video unless biometric identification or other biometric processing extracts facial maps, templates, or geometry for identification. Colorado law treats the resulting derived data as a biometric identifier subject to HB 24-1130. Adding a module that performs biometric identification triggers consent duties and the related written-policy and deletion obligations.

Biometric obligations require affirmative opt-in consent before collection and disclosure of the data types and their purpose. They also require a written policy covering retention schedules and deletion guidelines, including deletion of biometric identifiers once the purpose for collection has been satisfied.

Enforcement rests with the Colorado AG and district attorneys, with no private right of action.

Footage Retention Duties

Private-sector surveillance footage retention periods come from sector-specific rules rather than a universal Colorado requirement. Cannabis licensees under 1 CCR 212-3-3-225 must retain surveillance footage for at least 40 days, according to Colorado cannabis security guidance. Operators should preserve footage when litigation is pending or reasonably foreseeable, or when a specific law, policy, court order, or preservation request requires retention of footage that may hold relevant evidence. The 40-day baseline derives from this cannabis regulation. Security directors should set retention based on operational need and document the rationale.

Penalties and Legal Risks

A violation of § 18-7-801 is a class 2 misdemeanor. Invasion of privacy for sexual gratification under § 18-3-405.6 is a class 1 misdemeanor. Aggravating conditions such as a minor victim or prior sex offense conviction raise the offense to a class 6 felony. Any conviction for an unlawful sexual offense (or for unlawful sexual behavior as defined by Colorado law) requires sex offender registration. Audio violations under §§ 18-9-303 and 18-9-304 are class 2 misdemeanors.

On the civil side, intrusion upon seclusion exposes an operator to damages, with exemplary damages available under C.R.S. § 13-21-102 following amendment to the pleadings. Enforcement is asymmetric. District attorneys prosecute the camera-in-private-area prohibitions. Biometric obligations fall to the Colorado AG and district attorneys, while civil tort exposure runs in parallel to both.

Federal Overlays and Practical Compliance

The federal Electronic Communications Privacy Act (ECPA) covers communications rather than silent video, and camera placement rules come from state and context-specific law. When extending a policy across jurisdictions, compare Colorado against the laws of each state.

Practitioners should:

• Audit camera fields of view for restrooms, locker rooms, changing rooms, and bedrooms.
• Inventory microphone-capable cameras, disable unneeded audio, and post entry-point notice where audio remains turned on.
• Publish a written biometric policy and obtain opt-in consent before any biometric identification analytics.
• Set a documented retention period, restrict footage access, and apply a legal hold when an investigation is anticipated.

Matching Each Camera to the Right Legal Test

Colorado compliance comes down to matching each camera to the legal test that governs it. The stakes climb sharply when a system captures audio or runs biometric analytics. They also climb when a camera points into a private space. Matching each camera's location and audio or analytics configuration to the applicable statute is what keeps a deployment defensible.

Frequently Asked Questions

What are the penalties for placing a surveillance camera in a restroom or locker room in Colorado?

Knowingly observing or photographing another person’s intimate parts without consent in a place where that person has a reasonable expectation of privacy, such as a restroom or locker room, is a class 2 misdemeanor under Colorado section 18-7-801. If done for sexual gratification, the conduct may be charged under section 18-3-405.6 as a class 1 misdemeanor, or as a class 6 felony if there is a qualifying prior conviction or the victim is under fifteen. Higher penalties may apply under the separate invasion-of-privacy-for-sexual-gratification statute if the photography involved a person under age 15 or the defendant has a prior conviction. Convictions for invasion of privacy for sexual gratification—an offense that can involve placing a hidden camera in a restroom or locker room—require sex offender registration.

Do I need consent to use facial recognition or biometric analytics on existing CCTV footage in Colorado?

Yes. Colorado requires affirmative opt-in consent before collecting biometric identifiers. Running facial recognition on existing footage constitutes new sensitive data collection, triggering consent obligations under the Colorado Privacy Act and HB 24-1130, even when video was lawfully captured.

When is audio recording allowed on business security cameras in Colorado, and what notice is required?

Audio recording may be allowed under Colorado's business-premises exception when used on one's own premises for security or business purposes, provided reasonable notice is given to the public. Colorado's business-premises exception requires reasonable notice of the use of recording or eavesdropping devices to be given to the public, but the statute does not specify that notice must be posted at entry points.