Privacy & Cybersecurity Law Blog

On April 12, 2022, Colorado Attorney General Phil Weiser made remarks at the International Association of Privacy Professionals Global Privacy Summit in Washington, D.C., where he invited stakeholders to provide informal public comments on the Colorado Privacy Act (“CPA”) rulemaking.

In addition to this informal public comment, the Colorado Department of Law (“Department”) will begin the formal notice-and-comment rulemaking phase in fall 2022 by announcing a notice of rulemaking and accompanying draft regulations. Below are topics for which the Department specifically expects informal, pre-rulemaking feedback from interested parties, as listed under the pre-rulemaking guidelines:

• Universal Opt-Out – feedback is required to develop protocols and/or tools that can address universal opt-out mechanisms, which are technical measures that consumers may exercise to opt-out of the processing of personal data for targeted advertising or sale of personal data.
• Consent – input is required to clarify the textual definition of the consent under the CPA, particularly the following concepts: “clear, affirmative act,” “freely given,” “specific,” “unambiguous” and “informed.” The Department also seeks common methods of obtaining consent currently in use to meet the standards, as well as an adequate consent mechanism framework for parental consent.
• Dark Patterns – while the CPA expressly states using dark patterns does not constitute consent, further guidance is required regarding principles, frameworks and tools to identify dark patterns and avoid inadvertent use. Interested parties are invited to provide contributory research to reference and use case examples from the practice that impact or manipulate consumer choice.
• Data Protection Assessments (“DPA”) – The Department wants to clarify the form, content and circumstances of data protection assessments required by the CPA, and questions if it should follow any existing model, such as the EU General Data Protection Regulation, and acknowledge interoperability of DPAs conducted for another regime.
• Profiling – informal feedback is required to identify (1) what type of transparency would meaningfully enable consumers to understand the automated processing of personal data such that they can make informed opt-out decisions, (2) legal or civil rights concerns, (3) specific profiling applications that may warrant additional consideration or specific rules, and 4) the most effective strategy in similar legal regimes concerning profiling or automated decision making.
• Opinion Letters and Interpretive Guidance – the CPA authorizes the Attorney General to issue opinion letters and interpretive guidance, and public comment is requested regarding the type and process of interpretive guidance the rules provide.
• Offline and Off-Web Collection of Data – the Department wants to clarify how consumer rights and controller obligations apply to offline collection (through non-electronic methods such as signing a petition on a sidewalk) and use of personal data. 
• Protecting Coloradans in a National and Global Economy – the Department welcomes comments regarding the differences, overlap and interoperability between the CPA and other national and global jurisdictions to increase the participation of Coloradans in national and global markets and networks.

The Office of the Attorney General stated it will approach the rulemaking by embracing five principles: (1) promoting consumer rights; (2) clarifying ambiguities to minimize unnecessary disputes; (3) facilitating efficient and expeditious compliance for controllers and processors; (4) harmonization and facilitating interoperability of the CPA with other state, national and international frameworks; and (5) allowing for innovation and avoiding unduly burden on creativeness.

The CPA was enacted in July 2021 as the third U.S. state to adopt a comprehensive privacy law. The law contains express consumer rights, controller and processor obligations, enforcement provisions and interpretative guidance. The Colorado Attorney General also is given rulemaking authority in three distinct categories: (1) specific, required authority to draft technical specifications for one or more universal opt-out mechanisms; (2) specific, discretionary authority to create rules governing a process of issuing opinion letters and interpretative guidance; and (3) broader discretionary authority to create rules for the purpose of carrying out the CPA.