In a significant victory for consumer rights advocates, a bill that sought to weaken Colorado’s landmark right-to-repair law has been defeated. The proposed legislation, SB26-090, would have carved out a broad exception for “critical infrastructure,” a term left intentionally vague, allowing companies to withhold repair tools and documentation from consumers and independent repair shops. The bill’s failure represents a major setback for tech giants like Cisco and IBM, which had lobbied heavily for its passage, and a reaffirmation of the growing right-to-repair movement in the United States.
The original Colorado law, the Consumer Right to Repair Digital Electronic Equipment, took effect in January 2026 after being passed in 2024. It guaranteed consumers and independent repair providers access to the tools, parts, and documentation needed to fix a wide range of digital electronics, from smartphones and laptops to Wi-Fi routers and gaming consoles. The law was hailed as a model for other states and a crucial step in combating planned obsolescence and reducing electronic waste.
SB26-090 was introduced in the Colorado Senate on April 2, 2026, with the backing of major technology companies. It quickly passed the Senate committee hearing unanimously and later the full Senate on April 16. However, the bill faced stiff opposition in the House’s State, Civic, Military, and Veterans Affairs Committee. After hours of public testimony from both supporters and detractors, the committee voted 7-4 to postpone the bill indefinitely, effectively killing it.
Danny Katz, executive director of the local nonprofit consumer advocacy group CoPIRG, described the battle as a group effort. “While we were making progress at chipping away at the momentum for it, we had still been losing,” Katz wrote in an email after the hearing. “So, we took nothing for granted, and I believe the incredible testimony from the broad range of cybersecurity experts, businesses, repair advocates, recyclers, and people who want the freedom to fix their stuff made a big difference.” The coalition opposing the bill included national organizations like PIRG, Repair.org, iFixit, Consumer Reports, as well as local businesses and environmental groups such as Blue Star Recyclers, Recycle Colorado, Environment Colorado, and GreenLatinos.
The Cybersecurity Argument
Supporters of SB26-090, led by Cisco and IBM, argued that the original repair law posed a threat to national security. Their core contention was that requiring companies to provide repair tools and documentation to anyone could allow malicious actors to reverse-engineer critical technology, such as internet routers and other network infrastructure. By withholding these resources, they claimed, companies could better protect their systems from hackers. However, this argument was heavily scrutinized during the House committee hearing.
Cybersecurity experts who testified against the bill pointed out that the vast majority of hacks are conducted remotely, not through physical access to hardware or replacement parts. White hat hacker Billy Rios emphasized the real-time nature of cyber defense. “There is no time,” Rios said during the hearing. “It doesn’t work that way.” He explained that defenders need to make immediate changes to systems during an attack, without waiting for permission from equipment manufacturers. The notion that withholding repair documentation could prevent reverse engineering was also challenged, as many security vulnerabilities are discovered through independent research—research that repair rights actually facilitate.
In a curious moment during the hearing, Democrat Chad Clifford, a Colorado state representative and the House committee’s vice chair, pointed to Cloudflare’s well-known use of a wall of lava lamps to generate random encryption keys as an example of why certain security methods should remain secret. “I don’t know why anybody has to have lava lamps on a wall to keep the Chinese from getting into a network, but it’s what they came up with that worked,” Clifford said. “How they do that, I believe they should be able to keep it a secret, even in Colorado.” Critics noted that Cloudflare’s lava lamp setup is a public novelty, not a trade secret, and that security through obscurity is a misguided principle. The comparison did little to sway the committee.
Economic Threats and Legislative Reality
Beyond cybersecurity, proponents of the repeal effort raised economic concerns. Clifford warned that large tech companies might simply stop selling certain products in Colorado rather than comply with the repair law. “They’re not going to comply and give away the keys to their kingdom for the things that are securing billions of dollars of interest for their customers over the law that we passed,” he said. “What they’re going to do is just not have commerce on those items here.”
This threat of economic retaliation did not carry enough weight to change the outcome. Representative Naquetta Ricks, who voted against the bill, expressed skepticism about its true purpose. “What are we really trying to do here?” she asked. “Are we protecting just one company, or are we looking at really critical infrastructure? I’m not convinced.” Her comments reflected a broader sentiment among lawmakers that the term “critical infrastructure” was being exploited to undermine a popular consumer protection.
The failure of SB26-090 does not mean the fight is over. Nathan Proctor, senior director of US PIRG’s Campaign for the Right to Repair, acknowledged that lobbyists will likely continue their efforts in Colorado and elsewhere. “The fact of the matter is, unfixable stuff is everywhere,” Proctor wrote. “This is a widespread problem, and it requires a widespread response.” He pointed to recent repair laws passed in states like Iowa and the growing number of legislatures considering similar measures as evidence that the right-to-repair movement is gaining momentum.
Colorado’s original law remains one of the strongest in the nation. It requires manufacturers to provide repair information, tools, and parts for most digital electronic equipment sold in the state after 2021. The law does exempt certain medical devices and video game consoles, but otherwise covers a vast array of consumer electronics. The attempt to introduce a “critical infrastructure” loophole was seen by many as a test case for how tech companies might try to roll back repair rights across the country.
The broader context of the right-to-repair movement includes ongoing battles over intellectual property, planned obsolescence, and environmental sustainability. Right-to-repair advocates argue that when consumers cannot fix their own devices, they are forced to buy new ones, contributing to the growing e-waste crisis. According to the United Nations, global e-waste reached a record 62 million metric tons in 2022, and less than 25% of it was properly recycled. Laws like Colorado’s aim to extend the lifespan of electronics, reduce waste, and lower costs for consumers.
Tech companies, on the other hand, have long resisted repair mandates, citing concerns over safety, security, and loss of control over their intellectual property. The lobbying push in Colorado was part of a larger strategy to preempt or weaken similar laws in other states. Groups like the Consumer Technology Association (CTA) have argued that repair laws could stifle innovation and expose proprietary systems to theft. However, independent researchers and consumer advocates have repeatedly debunked these claims, noting that the fears of widespread hacking through repair tools are largely unfounded.
The Colorado hearing also highlighted the tension between cybersecurity and consumer rights. While it is true that some systems require careful handling to maintain security, security experts testifying at the hearing argued that openness and transparency are generally better for security than secrecy. The ability to inspect hardware and software for vulnerabilities is a cornerstone of good security practice. Companies that oppose repair rights often have financial incentives to lock consumers into their own repair networks, where they can charge premium prices for parts and services.
Despite the defeat of SB26-090, the battle lines remain drawn. Similar efforts to water down repair laws have been attempted or are being planned in other states. In California, a proposed bill to exempt certain “critical infrastructure” components failed last year. In New York, a Digital Fair Repair Act passed in 2022 but was heavily weakened before enactment. The movement is still young, and each legislative battle provides lessons for both sides.
For now, Colorado consumers and independent repair shops can breathe a sigh of relief. The right to fix their own electronics—from phones to routers—remains intact. But as technology evolves and the definition of “critical infrastructure” expands, the debate over who gets to repair what is far from settled. The Colorado case shows that when advocates and experts come together with compelling testimony, even well-funded lobbying efforts can be overcome. It also demonstrates that lawmakers are increasingly aware of the nuances between genuine security concerns and corporate overreach.
The failure of SB26-090 sends a clear message to the tech industry: consumers value their right to repair, and they are willing to fight for it. Whether this momentum can be sustained across the country remains to be seen, but for now, Colorado stands as a powerful example of what is possible when the public demands accountability from the companies that make the devices we rely on every day.
Source: Ars Technica News