Colorado Privacy Law Universal Opt Out Goes Into Effect July 1

One of the requirements of Colorado’s second generation privacy law is that data controllers must obey a consumer’s “do-not-track” preferences. The legislature passed the bill in 2021 and gave businesses three years to implement this.

The requirement goes into effect on July 1 – approximately 75 days from now.

There are some of the critical details.

Who does it apply to? Data Controllers. Data controllers are the entities that determine the purposes and means of processing consumer personal data. This would typically include companies and organizations collecting and using Colorado residents’ personal information.
Who does it apply to? Businesses that conduct business in Colorado (wherever they are actually located) or sell products or services targeted to Colorado consumers plus EITHER (a) or (b) below
(a) You control or process the personal data of 100,000 or more consumers a year (100,000 visitors to your web site, even if they are just looking, is not that much)
OR (b) You derive revenue or receive a discount from selling personal data and process the data of 25,000 or more consumers. That just cut the number of visitors to your website to meet that requirement by 75 percent.
If you meet either of (a) or (b) above, you are in.
The legislature told the attorney general to come up with a list of APPROVED Universal Opt-Out Mechanisms (UOOM) and publish that list. AG Phil Weiser did that.
There is EXACTLY one approved UOOM on that list. The list can be found at this link: https://coag.gov/uoom/
The approved mechanism is the Global Privacy Control or GPC. The details for GPC can be found at https://globalprivacycontrol.org/
Once you implement GPC, you must implement the user’s preferences as reported by the user’s browser.
The potential penalty is $20,000 per violation with a cap of $500,000 for a series of related violations.
The law can be enforced not only by the Colorado AG but also local district attorneys.
There is also a limited private right of action if the consumer is “injured”. Injuries are very “squishy”. If someone can convince the court that the consumer was injured, that is sufficient for the case to proceed.

If you have questions about this or need assistance, please contact us.