Colorado's Newly Released Data Privacy Regulations Get Specific Regarding Design And Technical Specifications

We have written previously regarding Colorado's adoption of the Colorado Privacy Act (CPA)—describing its provision of consumer data rights, how it may function within the context of the cannabis industry, and how business might consider the law as they renew their insurance coverage. And all this before the state released regulations accompanying the CPA.

On March 15, 2023, the Colorado Attorney General filed the final rules implementing the CPA to go into effect July 1, 2023. The following finalized rules are noteworthy—both for their technical specificity and their uniqueness. (Note: Capitalized words have specific definitions under either the CPA or the regulations.)

Universal Opt-Out Mechanisms. Companies must provide Consumers the opportunity to opt out of the sale or processing of their Personal Data for purposes of targeted advertising. A consumer may use a universal opt-out signal (generally through their web browser) that allows them to communicate