A handful of states are cracking down on the use of consumer personal data by creating and enforcing strict data privacy laws. The most recent action concerns privacy laws in the State of Colorado. For some months now, the State has been working to produce draft rules governing the collection, use, and dissemination of consumer personal information in accordance with the Colorado Privacy Act (“CPA”). The CPA is a part of the State of Colorado’s Consumer Protection Act. The CPA authorizes the Colorado Attorney General (“AG”) to adopt rules governing consumer privacy. According to the AG’s website, it is required to adopt rules that, among other things, set forth the specifications for “one or more universal opt-out mechanisms that clearly communicate a consumer’s affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data.”
What is “Secondary Use” Within the Meaning of the Colorado Privacy Act Draft Rules?
Additional Updates to the Colorado Privacy Act Draft Rules
The revisions are encapsulated in a 47-page document. Some of the more notable updates affect sections on profiling, universal opt-out measures, and data protection assessments. This is a complicated and cumbersome set of revised rules, which have not even been finalized. Another meeting is scheduled for February 1, 2023, that will address the revised regulations. Please keep in mind that the final rules are scheduled to go into effect on July 1, 2023.