· Statute · 5 sources
Colorado's repair law covers your phone. Its parts-pairing ban probably doesn't
Colorado's right-to-repair obligations reach devices first sold from July 2021. The parts-pairing ban inside the same act reaches only devices first sold after January 2026, and the statute says two things its own summary leaves out.
The short answer
Colorado’s Consumer Right to Repair Digital Electronic Equipment act, HB24-1121, took effect on 1 January 2026 and carries two different start dates inside it. The repair obligations, covering parts, tools and documentation, apply to digital electronic equipment first manufactured and first sold or used in Colorado on or after 1 July 2021. The ban on parts pairing applies only to equipment first manufactured and sold or used in the state after 1 January 2026. A phone bought in Colorado in 2024 is covered by the first and not the second.
Where this comes from
This is a reading of the enacted statute, not a test and not a summary of somebody else’s summary. Every quotation below is from the enrolled and signed text of HB24-1121, which is linked in Sources. I did not repair anything, contact any manufacturer, or observe any device behaviour for this piece.
That distinction matters more than usual here, because the Colorado General Assembly publishes a plain-language summary of the act on the bill’s own page, and most coverage works from it. The summary is accurate as far as it goes. It also stops short of two clauses in the statute that change what the provision means, which is the reason this piece exists.
What the statute says
The act defines the practice it regulates in one sentence:
“PARTS PAIRING” MEANS A MANUFACTURER’S PRACTICE OF USING SOFTWARE TO IDENTIFY COMPONENT PARTS THROUGH A UNIQUE IDENTIFIER.
The scope of the whole act rests on the definition of “digital electronic equipment”, which is a hardware product:
- (I)
- MANUFACTURED FOR THE FIRST TIME AND FIRST SOLD OR USED IN COLORADO ON OR AFTER JULY 1, 2021; AND
- (II)
- THAT DEPENDS, IN WHOLE OR IN PART, ON DIGITAL ELECTRONICS EMBEDDED IN OR ATTACHED TO THE PRODUCT IN ORDER FOR THE PRODUCT TO FUNCTION AS INTENDED.
The parts-pairing prohibition, at subsection (7)(a), carries its own and later date:
FOR DIGITAL ELECTRONIC EQUIPMENT THAT IS MANUFACTURED FOR THE FIRST TIME AND SOLD OR USED IN THE STATE AFTER JANUARY 1, 2026, A MANUFACTURER SHALL NOT USE PARTS PAIRING TO:
- (I)
- PREVENT AN INDEPENDENT REPAIR PROVIDER OR OWNER FROM INSTALLING OR ENABLING, OR INHIBIT AN INDEPENDENT REPAIR PROVIDER’S OR OWNER’S ABILITY TO INSTALL OR ENABLE, THE FUNCTION OF AN OTHERWISE FUNCTIONAL REPLACEMENT PART OR COMPONENT OF DIGITAL ELECTRONIC EQUIPMENT, INCLUDING A REPLACEMENT PART OR COMPONENT THAT THE MANUFACTURER HAS NOT APPROVED;
- (II)
- REDUCE THE FUNCTIONALITY OR PERFORMANCE OF DIGITAL ELECTRONIC EQUIPMENT; OR
- (III)
- CAUSE DIGITAL ELECTRONIC EQUIPMENT TO DISPLAY MISLEADING ALERTS OR WARNINGS ABOUT UNIDENTIFIED PARTS, PARTICULARLY IF THE ALERTS OR WARNINGS CANNOT IMMEDIATELY BE DISMISSED BY THE OWNER.
Two clauses in there do not appear in the General Assembly’s published summary.
The first is the tail of (7)(a)(III). The summary ends the sentence at “unidentified parts”. The statute continues: “PARTICULARLY IF THE ALERTS OR WARNINGS CANNOT IMMEDIATELY BE DISMISSED BY THE OWNER.” That phrasing makes non-dismissibility an aggravating factor rather than a requirement. A warning a person can tap away is not thereby permitted under the act; it is a weaker case than one they cannot.
The second is inside the carve-outs. Every summary I read describes the act as exempting biometric components, which is true but incomplete. The statute reads:
NOTHING IN THIS PART 15 PROHIBITS:
- (I)
- THE USE OF PARTS PAIRING TO ENABLE DIGITAL ELECTRONIC EQUIPMENT TO RECORD, CATALOG, AND DISPLAY INFORMATION RELATED TO REPAIRS DONE ON THAT DIGITAL ELECTRONIC EQUIPMENT; OR
- (II)
- A MANUFACTURER’S USE OF PARTS PAIRING FOR STANDALONE BIOMETRIC COMPONENTS USED FOR AUTHENTICATION PURPOSES IN DIGITAL ELECTRONIC EQUIPMENT, WHICH COMPONENTS ARE NOT BUNDLED IN COMMONLY REPLACED PARTS, SUCH AS A DEVICE’S SCREEN, KEYBOARD, PORTS
The exemption is for standalone biometric components, and it expressly withholds itself from biometric components bundled into commonly replaced parts. The statute names the screen. A fingerprint reader in its own button sits inside the carve-out. A face-authentication sensor built into a display assembly does not, on the face of the text.
What that means for any particular product is not something this piece can tell you. No regulator has applied the clause and no court has read it. What the statute draws is a line; where real hardware falls either side of it is an open question.
The bill that nearly reopened it
In February 2026, a month after the act took effect, Colorado Senate Bill 26-090 was introduced. It would have removed information technology equipment for use in critical infrastructure from Colorado’s consumer right to repair laws. The legislature’s summary defines the exempt category this way:
Critical infrastructure is defined as a system or asset, whether physical or virtual, so vital to the United States that the incapacity or destruction of the system or asset would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters.
iFixit published a warning about it on 1 April 2026, headlined “A New Colorado Bill Could Blow a Hole in the Nation’s Strongest Right to Repair Law”, arguing that the category was broad enough that regulated companies could point at it and walk away.
The legislature’s own record shows what happened next. The bill passed its Senate second reading on 7 April with no amendments and cleared third reading 35 votes to nil. It was introduced in the House on 21 April. On 27 April the House Committee on State, Civic, Military and Veterans Affairs voted to postpone it indefinitely. The bill’s status now reads Lost.
Whether the campaign against it is why it died is not something the voting record shows, and this piece does not claim it. What the record does show is that a unanimous state senate was six days behind that warning, and that a single House committee is the reason the carve-out is not law.
What it means for you
If you own a device in Colorado, the practical question is when it was first sold.
Equipment first sold or used in the state from 1 July 2021 gets the repair obligations: the manufacturer has to make parts, tools and documentation available to you and to independent repairers on fair terms. That reaches back nearly five years from the act taking effect, which is a genuinely wide net.
Equipment first sold or used in the state after 1 January 2026 additionally gets the parts-pairing protection. Everything older does not. A phone bought in 2023 or 2024 can still be paired in a way that reduces its functionality after a repair, or shows a warning about a part, and the act does not reach it.
For a repairer the same split decides what is arguable. On a device from 2022 the argument is about access to parts and documentation. On a device first sold this year the argument can also be about what the software does to a part once it is fitted.
One other obligation is worth noting, because it applies to the repairer rather than the manufacturer. Before providing services, an independent repair provider has to tell the owner that they are not an authorised provider of the manufacturer, and whether they are using new or used replacement parts from a supplier other than the manufacturer.
Parts pairing, as this act defines it, is about a manufacturer’s software refusing to recognise a part. It is worth keeping that separate from Activation Lock, Apple’s own anti-theft system for salvaged parts, which checks a part’s origin against a stolen-device record rather than against this kind of state law.