On June 8, the Colorado General Assembly passed Senate Bill 190, the Colorado Privacy Act (“CPA”). The bill now awaits signature from Gov. Jared Polis, who has ten days to sign off on or veto the bill.
One important development, among other key provisions in the bill, is the expanded recognition of technologies that must be recognized for consumers who wish to utilize their right to opt-out. The CPA grants consumers the right to “authorize another person, acting on the consumer’s behalf, to opt out of the processing of the consumer’s personal data… including through a technology indicating the consumer’s intent to opt out such as a web link indicating a preference or browser setting, browser extension, or global device setting.” 6-1-1306(1)(a)(II)
Additionally, effective July 1, 2024 (one year after the effective date of the law), a controller that processes personal data for targeted advertising or sale will have to recognize consumers’ right to opt-out through a “user-selected universal opt-out mechanism” that meets technical specifications which will be established by the Attorney General. 6-1-1306(1)(a)(IV)(B)
The bill incorporates the state privacy law trend seen in the California Privacy Rights Act of 2020 (CPRA) and the Virginia Consumer Data Protection Act (VCDPA) of expanding consumers’ options to use new technology to opt out.