Colorado AG Seeks Public Comment on Colorado Privacy Act
Previously, Kennedy Sutherland LLP reported on the pre-rulemaking efforts for the Colorado Privacy Act (“CPA”). On June 21, 2022, the Colorado Attorney General (“AG”) announced[1] that it was seeking informal public comment on the CPA prior to initiating its formal rulemaking process.
The AG accepted comments from “all interested parties” regarding, without limitation, “areas that need clarification, consumer concerns, anticipated compliance challenges, impacts of the CPA on business operations, cost concerns, and any related research or analyses” during the two informal public input sessions on June 22 and June 28, 2022.
The following were examples of the topics for which the AG is specifically seeking feedback:
Universal Opt-Out: Colorado residents will be permitted to “opt-out” of the sale of their personal data or the use of data for targeted advertising.
The AG is seeking “input to better understand what the clearest and most accessible type of universal opt-out would be for consumers, consumer expectations for how a universal opt-out mechanism might function, and potential technical limitations to any universal opt-out mechanism.”
Consent: Businesses will be required to receive a consumer’s consent prior to processing the consumer’s sensitive personal information or using the information in a manner not reasonably anticipated by a consumer based on the business’s disclosures.
The AG “would like to better understand what information would be most beneficial for consumers when a business asks for consent, especially when asking for consent to process sensitive personal data.”
Dark Patterns: Businesses will be required to obtain consumer consent without the use of “dark patterns” — efforts to obtain consent “in a way that is intentionally confusing or design its web page in a way that could trick you into consenting when you did not intend to.”
The AG “would like to better understand if there are certain online interactions where consumers are currently asked to provide consent that they find confusing or which have caused them to give their consent when they did not intend or desire to do so.”
Profiling: Consumers are able to opt-out of the automated processing of their personal data for the purpose of creating “profiles that may influence decisions that impact their civil rights.”
The AG “would like to better understand what type of information companies can provide to help consumers understand the automated processing of their personal data so that they can make an informed opt-out decision.”
Comments received during these sessions have yet to be released, but we will continue to provide updates on the CPA rulemaking process.