Meetings and Events

The next steps are afoot in setting up stronger requirements for protecting consumer data privacy in Colorado.

The Colorado Attorney General's Office is seeking public comment on draft rules tied to 2021 legislation that will allow consumers more control over their personal data, including a so-called "universal opt-out."

The draft rules being considered include:

·         Definitions and clarifications of key terms such as “biometric data,” “bona fide loyalty programs,” and “publicly available information”

·         Description of how Coloradans may exercise new rights over their personal data, including the right to access and correct personal data and to opt out of the sale of personal data, or use of personal data for targeted advertising or profiling

·         Technical specifications for a tool or mechanism that will allow consumers to opt out of the processing of personal data by all businesses, instead of on a case-by-case basis

·         The duties of entities that use and control consumers’ personal data, including obligations to safeguard personal data and protect consumer privacy

·         A clarification that disclosures and limitations associated with the user of Coloradan’s personal data for bona fide loyalty programs, or programs that offer discounts, rewards, or other actual value in exchange for personal data

·         A clarification that the requirements for obtaining consent from Coloradans prior to specific uses of personal data, and addresses the prohibition against obtaining consumer agreement through unclear or ambiguous means, often called “dark patterns”

·         Description of how the required scope, content, and timing of data protection assessments, which controllers must complete before using personal data for activities that present a heightened risk of harm to consumers

·         When and how controllers must respond to consumers' request to opt-out of specific kinds of automated profiling as well as what controllers must include in data protection assessments when conducting automated profiling

Nearly four dozen comments have already been submitted.

The attorney general's office is also holding virtual stakeholder meetings on Nov. 10, Nov. 15, and Nov. 17, with a rulemaking hearing to follow on Feb. 1