Colorado School Internet Safety Laws: CIPA, C.R.S. 22-87 and More
Colorado is one of the states with its own school internet protection article on top of federal CIPA. This guide explains both, adds the student data and phone rules that shape your setup, and ends with a checklist you can use this year.
For district technology leaders, school librarians and charter operators. Planning guidance, not a legal opinion.
Yes, Colorado adds its own rule
Every Colorado public school district must adopt and keep enforcing a policy of internet safety for minors under C.R.S. 22-87. That applies even without E-Rate. Federal CIPA applies on top whenever the district takes E-Rate for internet access or internal connections.
Colorado also regulates how filter and monitoring vendors handle student data, and requires a phone policy by July 1, 2026.
One configuration that answers both the federal law and your state policy
Colorado districts must keep an internet safety policy for minors under C.R.S. 22-87, with or without E-Rate. Our hosted CIPA filter sets the blocking side of that policy with categories, and each school can hold its own grade-appropriate settings.
- Adult and VPN/Proxy/Anonymizers are switched on in the CIPA preset
- Elementary, middle and high schools can run different category choices
- Reports and a policy record show the board what the policy does in practice
What federal CIPA requires
CIPA is the baseline every E-Rate school in Colorado works to. If you need the full picture first, start with what CIPA is and who it covers.
The three duties
- Filter: a technology protection measure that blocks visual depictions that are obscene or child pornography, and harmful-to-minors depictions on computers minors use.
- Policy: an internet safety policy on inappropriate material, email and chat safety, hacking, disclosure of minors' personal information and the filter, adopted after public notice and a hearing or meeting.
- Monitoring and education: oversight of minors' online activity, plus lessons on online behavior, social networking safety and cyberbullying.
How it is certified
- Schools and libraries certify on FCC Form 486 each funding year.
- Consortium members certify to their lead on FCC Form 479.
- An authorized person may disable the filter for an adult doing bona fide research or other lawful work.
- False certification can lead to repayment of discounts, so the evidence behind it matters.
What Colorado adds: the state laws that touch school filtering
Four pieces of Colorado law and one failed bill are worth knowing. Only the first is a filtering law. The others shape the policies and contracts around the filter.
Children's Internet Protection (public schools)
Each district's governing body had to adopt and implement a policy of internet safety for minors by December 31, 2013, and must keep enforcing it. It applies to districts regardless of E-Rate.
Freedom to block more
The article does not stop a local board or school from blocking other material on technology devices it owns or operates. Extra categories are a local choice.
Student Data Transparency and Security Act
Enacted as HB16-1423. It sets transparency, security, use and deletion duties for school service contract providers that handle student personally identifiable information.
Student communication device policies
Signed May 1, 2025. Local boards and charter schools must adopt, implement and post online a phone and device policy by July 1, 2026.
Public library internet protection
A separate article for public libraries. Its definition of a technology protection measure also says it should not block scientifically or medically accurate sexual health information. Check the current text.
Social media bill: not law
Passed both chambers, vetoed by the governor. The Senate voted to override, but the House laid the override over, so the bill died.
Key definitions in Colorado's internet protection article
The definitions in C.R.S. 22-87-103 decide what your policy has to cover. They track the federal approach closely, which makes one filter configuration serve both laws.
An individual who has not reached the age of seventeen. CIPA uses the same age for harmful-to-minors material.
A three-part test: appeals to a prurient interest, is patently offensive as to what suits minors, and lacks serious literary, artistic, political or scientific value as to minors.
Computers, hardware, software or other technology used for learning that can connect to the internet. That reaches well beyond lab desktops.
A device has access when it is connected to a network that provides internet access, including school Wi-Fi.
Any public school district organized under Colorado law, except a local college district.
Borrowed from federal law, 18 U.S.C. 2246, so the content standard is the same one your filter categories already target.
CIPA and C.R.S. 22-87 side by side
Most Colorado districts are covered by both. This comparison shows where they agree and where the state rule reaches further.
| Question | Federal CIPA | Colorado C.R.S. 22-87 |
|---|---|---|
| Who is covered | Schools and libraries taking E-Rate for internet access or internal connections | Every public school district, E-Rate or not |
| Trigger | Funding condition | State statutory duty |
| Age of a minor | Under 17 | Under 17 |
| Content standard | Obscene, child pornography, harmful to minors | Harmful to minors defined with a similar three-part test |
| Policy required | Internet safety policy after public notice and hearing | Policy of internet safety for minors, adopted and enforced |
| Blocking more | Allowed, local choice | Expressly allowed by 22-87-106 |
| Proof | Form 486 or 479 certification | Board adoption and ongoing enforcement |
Which Colorado schools are covered by which rule
Colorado has several school types, and the answer is not the same for each. Use this as a starting point and confirm edge cases with counsel.
| School type | Federal CIPA | C.R.S. 22-87 | HB25-1135 |
|---|---|---|---|
| Public school district | Yes, if it takes E-Rate for internet access or internal connections | Yes, the governing body adopts the policy | Yes, local board policy |
| District charter school | Yes, if E-Rate applies to it directly or through the district | Check how the district policy reaches the charter | Yes, charter schools are named |
| Institute charter school | Yes, if it takes E-Rate | Ask counsel, as it is authorized outside a district | Yes, charter schools are named |
| BOCES or consortium member | Yes, certified through Form 479 to the lead | Follows the member district's policy | Follows the member school |
| Private school | Yes, if it takes E-Rate | No, the article covers public districts | No |
Four Colorado situations we see often
The statutes are short. The hard part is applying them to ordinary days in a school. These are the situations that most often raise questions.
Take-home devices
- The state definition of technology device covers learning devices wherever they connect.
- Decide whether filtering follows the device home and write that decision into the policy.
- Our guide to off-campus device filtering compares agent and DNS options.
Health and research topics
- Neither CIPA nor 22-87 requires blocking medical or sexual health information.
- High school rule sets should keep Health & Medicine and Education/Reference open.
- Over-blocking draws complaints and gives no extra compliance credit.
Staff and adult access
- Adults still need obscene and child abuse material blocked.
- Other categories can be opened for staff under a separate rule set.
- Keep a short record of who may approve an adult disable and why.
Vendor changes
- A new filter or monitoring vendor is a new school service contract under 22-16.
- Get the data inventory and deletion terms before go-live.
- Confirm the old vendor deleted or returned student data and keep the confirmation.
Sites a Colorado elementary and a high school may treat differently
A single category can be right for one grade band and wrong for another. These sites show why separate settings per school matter.
| Site | Categories in our data | Possible grade-band thinking |
|---|---|---|
| youtube.com | Streaming Media, Social Networking | Open for lessons in high school, tighter for younger grades |
| khanacademy.org | Education/Reference | Open in every band |
| roblox.com | Gaming | Usually off during class time |
| twitch.tv | Streaming Media, Gaming | A choice for older students only |
| wikipedia.org | Education/Reference | Open, with source teaching |
Student data law: what it means for filter and monitoring contracts
Filters and monitoring tools see a lot of student activity. In Colorado that makes the vendor contract a compliance document, not only a purchase order.
Transparency
Contract providers must explain in plain language what student data they collect, why, and how it is used and shared.
Security program
Providers are expected to keep an information security program that fits the data they hold.
Deletion
Data must be destroyed on request of the education entity or at the end of the contract, on the timeline the contract sets.
Use limits
The law limits how student data may be used and sold. Adaptive and personalized learning uses are carved out.
Termination list
A material breach can lead the school to end the contract, and the provider can be listed publicly as terminated.
Parent access
Parents can request a copy of their child's personally identifiable information, including what a contract provider holds.
HB25-1135 phone policies and your network
Colorado's phone law leaves the content of the policy to local boards. It sets a deadline and a few floors.
What the law requires
- Adopt, implement and post online a policy on student phone and device possession and use during the school day.
- Deadline: July 1, 2026, for local boards and charter schools.
- Policies must allow for disability standards, special education plans, medical monitoring and emergencies.
- Not required where a qualifying policy was adopted and implemented on or before August 31, 2025.
- The Department of Education was to publish supporting resources by January 5, 2026.
What it means for filtering
- The phone law governs devices in the building, not network filtering.
- Phones that join school Wi-Fi should land on a student network with the same category rules.
- Phones on cellular data bypass the filter, so the policy is the only control there.
- Block the VPN / Proxy / Anonymizers category for students, so a phone on Wi-Fi cannot tunnel around the filter.
What it means for filtering and monitoring in Colorado
One configuration can satisfy CIPA and 22-87 together. These steps turn the statutes into settings.
- Block Adult content for every userObscene material and child sexual abuse material are blocked for adults and students alike under CIPA.
- Add harmful-to-minors categories for studentsTypical student blocks include Gambling, Illegal Drugs, Weapons, Violence, Hate/Discrimination, Dating, Lingerie/Swimsuits/Intimate Apparel and VPN / Proxy / Anonymizers.
- Cover every "technology device"Apply rules to take-home devices, tablets and any learning device that reaches the internet, in line with the state definition.
- Separate grade bandsElementary, middle and high school rule sets keep research, health and news sites open where older students need them.
- Decide on extra categories openlySocial media, streaming or AI tools for schools are local decisions under 22-87-106. Record the reason in the policy.
- Keep monitoring proportionateCategory reports and alerts on high-risk categories meet the monitoring duty with far less student data than full history capture.
- Keep the category data freshNew domains appear daily. A category database that classifies newly registered domains each day closes the gap a static list leaves.
- Test and recordSpot-check sites with the domain category checker and keep the results with your E-Rate evidence.
Reports at the level of domains and categories
The hosted filter does not look inside pages or read messages, and it gives you activity reports, a policy record and a log export. That is a short story to tell your board when the question is how much student detail a vendor holds.
Colorado compliance checklist
Use this once a year, and whenever a filter or monitoring contract renews. The general CIPA compliance checklist explains each federal item in more depth.
- Board-adopted policy of internet safety for minors in force (22-87)
- CIPA internet safety policy covers all required topics
- Public notice and hearing or meeting documented
- Filter on every internet-capable technology device
- Adult content blocked for all users
- Harmful-to-minors categories blocked for students under 17
- Adult disable process written down
- Online safety lessons delivered and recorded
- Filter and monitoring contracts reviewed under C.R.S. 22-16
- Vendor data inventory and deletion terms on file
- HB25-1135 phone policy adopted and posted online
- Form 486 or 479 filed on time
Evidence to keep
Two audiences may ask for proof: E-Rate reviewers for CIPA, and your board, parents or the state for 22-87 and 22-16. One folder per year serves both.
| Record | Proves | Law |
|---|---|---|
| Board resolution and minutes adopting the internet safety policy | Adoption and enforcement | CIPA, 22-87 |
| Hearing or meeting notice and agenda | Public process | CIPA |
| Filter rule set exports with dates | Required categories blocked | CIPA, 22-87 |
| Device inventory showing filter coverage | All technology devices covered | 22-87 |
| Online safety lesson records by grade | Education duty met | CIPA |
| Vendor contracts, data inventories and deletion confirmations | Student data handled as required | 22-16 |
| Posted phone policy and posting date | Phone rule met | HB25-1135 |
| Filed Forms 486 or 479 | Certification | CIPA |
Meeting CIPA and C.R.S. 22-87 with the tools you have or a hosted filter
These rows follow the steps a Colorado district takes to turn two laws into settings.
| Colorado step | Current setup, typical | Hosted CIPA filter |
|---|---|---|
| Blocking for the federal duty | Rules in the firewall or an older filter | Category blocking, Adult and VPN/Proxy/Anonymizers in the preset |
| Grade-appropriate settings | One policy copied across schools | Separate settings per school or branch in one console |
| Rural and mountain campuses | Hardware at every site | One DNS setting, nothing installed on computers |
| Take-home devices | Depends on how each is managed | A private encrypted link keeps the school's rules on the device |
| Evidence for E-Rate and the board | Exports pieced together | Activity reports, policy record and log export |
| Teacher needs a blocked page | Edit a list and undo it | PIN bypass for 15, 30 or 60 minutes, logged, then it switches back |
Colorado school internet safety FAQ
Does Colorado have its own school internet filtering law?
Yes. C.R.S. 22-87, titled Children's Internet Protection, requires each public school district to adopt, implement and keep enforcing a policy of internet safety for minors, adopted by December 31, 2013. It applies with or without E-Rate.
How does Colorado define a minor here?
C.R.S. 22-87-103 defines a minor as an individual under seventeen. Federal CIPA uses the same age for harmful-to-minors material, so one student rule set can serve both.
Can a Colorado district block more than the law requires?
Yes. C.R.S. 22-87-106 says the article does not stop a board or school from blocking other material on devices it owns or operates. Record the reasons for extra blocks in your policy.
Does student data law apply to our web filter vendor?
It can. If the vendor provides a school service under a negotiated contract and handles student personally identifiable information, C.R.S. 22-16 applies. Ask counsel to review the contract terms.
What does HB25-1135 require?
A posted phone and device policy from each local board and charter school by July 1, 2026, with disability, medical and emergency exceptions. It does not apply where a qualifying policy was in place by August 31, 2025.
Did Colorado pass a social media law for minors in 2025?
No. SB25-086 passed both chambers but was vetoed. The Senate voted to override, the House laid the override over, and the bill died.
Do Colorado public libraries have filtering rules too?
Yes, under a separate article in Title 24, Article 90, Part 6. Libraries taking E-Rate for internet access also follow CIPA. Check the current text with library counsel.
Does C.R.S. 22-87 apply to staff computers?
The article is framed around internet safety for minors. CIPA still requires obscene material and child sexual abuse material to be blocked for adults, so staff devices need that baseline, with a written adult disable process for lawful research.
How often should we review our setup?
Yearly before the E-Rate window, and again when a filter or monitoring contract renews or a new device program starts.
Other state school internet safety laws
Compare Colorado with nearby and peer states.
For every state we cover, see our school internet safety laws by state overview.
Related guides
- CIPA Internet Safety Policy: What It Must Contain and How to Write One
- Student Data Privacy, FERPA and Web Filtering
- Presenting Web Filtering to the School Board: Budget, Risk, Metrics
- New Mexico School Internet Safety Laws: CIPA and SB 11 Phones
- Wyoming School Internet Safety Laws: CIPA and Phone Policy
A quote depends on how many schools and devices you have, and it arrives within one business day. Putting one Colorado school on a pilot shows the blocks and reports before the board decides.
Talk to us about your district
See how CIPA category coverage, grade-band rules and category-level reporting can meet Colorado's internet safety duty with less student data.