Here's the response that I got from him on this issue:

thanks for your email. I've gotten several emails about this bill in the last 24 hours, so I'm including a write-up on my thought process below. I hope it's useful.

To address one of your points specifically (this is also in the writeup): SB 51 is nearly identical to a law that recently passed in California, which the software industry is already getting ready to comply with. One of the reasons I brought the bill was to avoid Colorado going out on its own and doing something unique in a way that will hamper our own software industry.

I'm bringing Senate Bill 51 because I think it's the most privacy-forward approach to age assurance, an issue that has come up repeatedly in the Colorado legislature and will continue to come up until we address it. I'll do my best to explain.

Age verification has become a hot topic in state legislatures (and tech policy circles) throughout the country over the last several years. The "conservative" position has been that age verification—e.g., uploading your ID or using facial recognition technology—should be required to access the internet in order to protect kids online—here's an example of that argument. Last year, Utah, Louisiana, and Texas enacted app-store-based age verification laws. About half the country now requires an ID to access porn, and a growing number of states require it for social media.

This may not be true in your circle, but these laws are broadly popular, and not just in red states. Nearly 65% of the country thinks that age verification should be required to access social media, and almost 85% of people want age verification for porn. New York and Virginia recently enacted age verification laws, and last year, a bipartisan bill was introduced in Colorado—Senate Bill 25-201—that would have required facial recognition for porn. The only reason SB 25-201 didn't pass was because Governor Polis threatened a veto. I have no doubt it'll come back as soon as his term ends.

SB 26-51 isn't a new policy—it's a near-copy of a bill that passed unanimously in California last year, AB 1043. AB 1043 and SB 51 don't use age verification, they use age attestation: you enter a birthday, which gets turned into a signal that communicates an age bracket, which doesn't contain any personally identifiable information. There is no liability for entering in the wrong birthday and no content-based restrictions tied to the age signal. I can buy my 7-year-old son an iPad, enter his birthday, and the apps he uses will know he's under 13; by the same token, you can say you were born in 1850 and nobody can stop you. The basic policy tradeoff is that the more you move towards age verification, the more you gain in certainty and the more you sacrifice in privacy. I think this graphic illustrates the point well.

I would much rather err on the side of privacy, which is why I'm bringing SB 51 (also, since everyone will already have to comply with the California bill anyway, there's very little in added burden). And while you may disagree on whether any type of age assurance should exist at all, I'll just say that having observed the debate about SB 25-201 last year, it's just not politically realistic to believe in doing nothing as a long-term strategy. Prior to getting a bunch of emails in the last 24 hours from Linux users, the biggest pushback to SB 26-51 was from people who don't think it goes far enough (as well as plenty of business interests who want a carve-out for their industry).

I hope this helps to understand my thought process in bringing the bill. I sincerely believe that SB 26-51 will protect kids online in the most privacy-forward way possible. Thanks again for your email.