C.R.S. § 24-72.3-102

(1) A public entity shall not issue a license, permit, pass, or certificate that contains the holder’s social security number, unless the issuing authority determines inclusion of the social security number is necessary to further the purpose of the license, pass, or certificate or inclusion is required by federal or state law. (2) A public entity shall not request a person’s social security number over the phone, internet, or via mail unless the public entity determines receiving the social security number is required by federal law or is essential to the provision of services by the public entity.