Austin and Denver algorithm audits: why state law, not the city, sets the duties

What to take away

The audit duties come from state law. Austin sits under Texas law and Denver under Colorado law, so the city name changes less than the state does.
Texas has a comprehensive privacy statute, the Texas Data Privacy and Security Act. Its data protection assessment duties apply to profiling and targeted advertising.
Colorado's Privacy Act requires a data protection assessment before processing that presents a heightened risk of harm, and profiling is one of the listed risk categories.
Texas also applies its Deceptive Trade Practices Act to public claims about how a platform works, so a claim must match the code.
One evidence file, built to Colorado's assessment standard, can usually be reused for a Texas inquiry with edits.

Why the city does not change the rule

Austin and Denver are both cities, and their residents and companies are subject to the laws of their states. This article found no city-level rule on algorithm audits that changes the state duties. Check each city's current code before relying on that conclusion.

For a platform, the practical question is which state's residents it serves and which state's statute applies to the processing. A platform with users in both states has to meet both sets of duties.

Texas: the privacy statute and the consumer protection statute

Texas has two tools that matter here. The first is the Texas Data Privacy and Security Act, which took effect in 2024. It gives consumers data rights and requires controllers to conduct data protection assessments for certain processing, including profiling and targeted advertising.

The second is the Texas Deceptive Trade Practices Act. The attorney general uses it against businesses whose public claims do not match their conduct. Texas has sued large technology companies under this statute over privacy and minor-safety claims.

Texas also passed the Texas Responsible Artificial Intelligence Governance Act in 2025. It adds duties for certain artificial intelligence systems. Check its current effective date and scope in the enrolled text before relying on it, because the operative dates for new AI statutes are often changed.

Colorado: the privacy assessment and the AI Act

The Colorado Privacy Act has been in force since 2023. It requires controllers to conduct a data protection assessment before processing personal data in ways that present a heightened risk of harm to consumers. Profiling is one of the listed risk categories.

The assessment is not a public audit. It is a written record that must be kept, and the Colorado attorney general can request it.

Colorado also enacted the Colorado Artificial Intelligence Act, SB 24-205, which imposes duties on developers and deployers of high-risk artificial intelligence systems, including impact assessments. A 2025 amendment (SB 25B-004) moved its start to June 30, 2026, and 2026 court and legislative action may have changed it again. Confirm the current date and scope before planning a release.

What this means for a platform in Austin

A platform serving Texas users must be able to show that each public claim about ranking, targeting or moderation matches how the system works. If its marketing says a feed is chronological, or that it does not use certain categories of data, the code has to support that statement.

The practical work is a claim-to-code file:

List every public claim about ranking, targeting or moderation made to Texas users.
Trace each claim to the code or policy that implements it.
Record any gap, then either correct the claim or change the system.
Keep the record with dates, owners and version numbers.
Repeat the check when the ranking model changes.

The Texas data protection assessment duty for profiling and targeted advertising is a separate requirement, and it needs its own written assessment.

What this means for a platform in Denver

A platform serving Colorado users must complete a data protection assessment before any processing that presents a heightened risk of harm. The assessment has to describe the processing, the benefits, the risks to consumers and the safeguards in place, and it has to be kept.

Teams often fold that assessment into an existing vendor or model review. That keeps cost down, but it can make the assessment hard to find when a regulator asks for it. Keep it as a separate, named document.

Data minimization also matters in Colorado. Risk is tied to the volume and sensitivity of the data a model uses, so a ranking model that relies on precise location data needs a stronger justification than one that uses coarse signals.

Compliance steps that cover both states

A single audit process can cover Texas and Colorado if it produces two outputs: a Colorado-style written assessment and a Texas-style claim verification file. Build the assessment first, because it is the more demanding document, then derive the Texas file from it.

Checklist for producing Colorado assessment and Texas claim verification file (Do Austin and Denver algorithm audits differ under Texas and Colorado law?) — The steps that let one audit process support both Colorado and Texas requirements. Image: App Policy Regulation

Two operational rules keep this manageable. First, keep one evidence repository, tagged by state, claim and model version, so a Texas request and a Colorado request draw on the same source. Second, date everything, because both regimes care about what the company knew and when it knew it.

Many audit tools are built for one framework and do not produce output that satisfies both states. Check whether a tool can export the Colorado assessment fields before buying it.

Where the two states diverge

Texas

Core privacy statute: Texas Data Privacy and Security Act (2024)
Algorithm-related duty: Data protection assessment for profiling and targeted advertising
Written assessment required: Yes, for profiling and targeted advertising
Consumer-protection hook: Deceptive Trade Practices Act for public claims
Lead enforcer: Texas attorney general
AI-specific statute: Texas Responsible Artificial Intelligence Governance Act (2025)

Colorado

Core privacy statute: Colorado Privacy Act (2023)
Algorithm-related duty: Data protection assessment for heightened-risk processing, including profiling
Written assessment required: Yes, retained and producible on request
Consumer-protection hook: Consumer protection enforcement under the state Consumer Protection Act
Lead enforcer: Colorado attorney general
AI-specific statute: Colorado Artificial Intelligence Act, SB 24-205

The timing differs. Colorado requires the assessment before processing begins. Texas requires its assessments for profiling and targeted advertising, and public claims are judged against what the company actually does. That is why a Colorado calendar is predictable and a Texas risk tends to arrive after a complaint or a public statement.

The scope differs too. Colorado's trigger is risk to consumers, which pulls in data inputs and model design. Texas's trigger includes public claims, which pulls in marketing copy and user-facing behavior. An audit built for only one state will miss the other's core question.

Enforcement style differs as well. Texas has litigated against large platforms in public cases. Colorado's enforcement has been less visible in public filings, so the practical risk there is the routine request for the assessment.

Common questions

Do Texas and Colorado require algorithm audits by name?

Not in those words. Both states require written data protection assessments for certain processing, and profiling is covered in both. Colorado also has an AI statute with its own duties.

Do Austin and Denver have their own algorithm audit rules?

This article found none that change the state duties. Check each city's current code.

Can one audit satisfy both states?

Often yes, if it produces a Colorado-style written assessment and a Texas-style claim verification record drawn from the same evidence.

Which state is riskier for a social platform?

Texas carries more visible litigation risk, because the attorney general has sued large platforms under the Deceptive Trade Practices Act. Colorado carries more routine paperwork risk, because the assessment must exist before processing.

What should a Denver platform do first?

Decide whether its ranking or targeting is profiling that presents a heightened risk of harm. If it is, write and keep the assessment before launch.

What should an Austin platform do first?

Inventory every public claim about how its feed or targeting works, then check each one against the code.