On October 1, 2022, the Colorado Attorney General’s Office submitted an initial draft of the Colorado Privacy Act Rules (“CPA Rules”), which will implement and enforce the Colorado Privacy Act (“CPA”). The CPA Rules, which are currently about 38 pages, address many recent issues in state data privacy regulation, including data profiling, data protection, automated data processing, biometric data, universal opt-out mechanisms and individual data rights.

In addition, the Colorado Attorney General’s Office included with the Rules a Notice of Proposed Rulemaking, which provides a non-exhaustive list of topics on which the Colorado Attorney General’s Office seeks public input, and a Statement of Basis, Specific Statutory Authority, and Purpose, which provides regulatory insight on the drafting of the rules.

The Attorney General’s Office published the CPA Rules in the Colorado Register on October 10, 2022, where the Notice of Proposed Rulemaking, the Statement of Basis, Specific Statutory Authority, and Purpose and the draft CPA Rules are accessible to the public.

Summary of Proposed Regulations

The proposed regulations, if adopted, would add certain significant new compliance obligations on businesses. Below are key examples of topics addressed by the proposed regulations.

Right to Request to Exercise Personal Data Rights (Rule 4.02 – Rule 4.07; 6.11)

The proposed regulation provides the people of Colorado with a mechanism to protect their personal data rights by making requests directly to data controllers, or businesses who control their personal data. These data rights include:

• The right to opt out – businesses must provide an opt-out method, either directly or through a link, clearly and conspicuously in its privacy notice and a readily accessible location outside the privacy notice (for example, an available link stating “Colorado Opt-Out Rights,” “Personal Data Use Opt-Out” or “Your Opt-Out Rights”);

• The right of access – when requested, businesses must provide consumers with information about all the personal data it has collected and maintained about the consumer, including information obtained in providing services to the company;

• The right to correction – businesses must comply with a consumer’s request to correct information about their personal data and make it accessible through their account settings;

• The right to deletion – businesses must comply with a consumer’s deletion request, delete the personal data permanently from their existing systems and notify the consumers of deletion of their personal information; and

• The right to data portability – businesses must be able to transfer personal data to consumers through a secure method (in a commonly used electronic format).

Businesses are required to document and maintain records of all consumer data rights requests, in a readable format, for at least twenty-four (24) months. Information from these requests cannot be used for any purpose beyond compliance with the CPA and must be maintained with reasonably security procedures and practices.

Authentication (Rule 4.08)

Rule 4.08 of the proposed regulation requires “controllers” to establish “reasonable methods” to authenticate consumers who submit data rights requests. When determining reasonability, the CPA Rules provide several factors, including the data rights exercised, the type, sensitivity, value and volume of personal data involved, and the level of possibly harm that improper access or use could cause to the consumer submitting the data right request. The CPA further provides that businesses should not place an unreasonable burden on consumers to submit data rights requests.

Universal Opt-Out Mechanism (Part 5)

The proposed regulation provides guidance on to how to implement universal opt-out mechanisms and provide resources to the public on how to best use these tools. For example, the Colorado Department of Law will maintain a public list of opt-out mechanisms that have been recognized by the AG’s Office. These opt-out mechanisms will not use, disclose or retain any personal data collected from consumers and provide to consumers an easy methodology to exercise their opt-out rights to all businesses without making individual requests to each of them. However, the CPA Rules also enable for businesses to seek affirmative consent from consumers, who have opted-out through the universal opt-out mechanism, to collect their data.

Guidance on Privacy Notices under the CPA (Rule 6.01 to 6.04)

The proposed regulation further specifies how businesses must draft privacy notices and guidance on how to comply with the CPA Rule. The proposed regulation provides that privacy notices should be clear, easily accessible and specific. The privacy notice should also describe in detail how businesses process consumer data. For example, the CPA Rules require businesses to disclose whether they collect personal data and if they share this data to third parties. Furthermore, businesses must notify consumers of substantive or material changes to their privacy notices and provide that notice 15 calendar days before the change goes into effect.

Bona Fide Loyalty Benefits (Rule 6.05)

The proposed regulation, under Rule 6.05, provides insight into how data rights may affect loyalty programs and provides specific disclosures for these programs. The proposed regulation requires specific disclosures in their privacy notices, including the personal data collected, information on third parties who receive this information and information on the value of loyalty programs when a customer chooses whether to opt-out.

Data Minimization (Rule 6.07)

The CPA Rules provide that businesses should only collect information that is reasonably necessary for a specified purpose and determine, by way of documented assessment, the minimum amount of personal data that is necessary for that express purpose. The proposed regulations set specific time limits for data removal and periodic review of data practices. More specific to biometric data, businesses should review, at least once a year, whether storage of certain biometric data is necessary and receive consent each subsequent year after collection.

Consent (Rule 7.01 – 7.08)

The CPA Rules provide significant guidance on the consent requirements for personal data collection from consumers. Some of the consent requirements include:

• Businesses are required to get consent when they are processing consumers’ sensitive data, processing personal data of a known child, selling data or using data for targeted advertising or profiling, or collecting data outside of their original specified purpose;

• Valid consent requires (1) consumers to provide clear, affirmative action to show consent; (2) consumers to give consent freely; (3) consumers to be able to separately consent to a specific purpose; (4) consumers to be informed via specific disclosures from the company collecting the consumer’s data; and (5) the consent must reflect an unambiguous agreement;

• Businesses must provide simple mechanisms to receive consent from consumers. If a consumer has opted out, by way of a universal opt-out signal or directly with the business, the business must provide a simple mechanism to receive consent from consumers. Similarly, businesses must provide consumers with an easy mechanism to refuse or revoke consent;

• Businesses are required to take commercially reasonable steps to verify a consumer’s age before processing their data if they have actual knowledge that they may be collecting or maintaining personal data of a child. Businesses must get consent from parents to process the information collected about children, and take reasonable efforts to verify consent; and

• Businesses must obtain “refreshing consent” for processing sensitive data; where businesses will be required to obtain new consent when a business’ purpose of data collection materially evolves or annually.

Dark Patterns (Rule 7.09)

Under the proposed regulation, dark patterns exist when companies use an interface design or choice architecture that has the substantial effect of subverting or impairing user autonomy, decision making or choice, or unfairly, fraudulently or deceptively manipulating or coercing a consumer into providing consent. Dark patterns are not permitted, and are not considered valid consent.

Data Protection Assessments (Rule 8.04)

The proposed regulation requires businesses to conduct data protection assessments. Currently, Rule 8.04 highlights a list of 18 elements that must be addressed in each assessment, including processing activity; specific purpose of processing activity; specific types of personal data to be processed; how the personal data is to be processed is adequate, relevant, and limited to what is reasonably necessary to the specified purpose; operational details for processing; names and categories of personal data recipients (such as third parties, affiliates and data processors); the relationship between the controller and the consumer whose personal data will be processed; the expectations of the consumer; procedural safeguards provided to the consumers when personal data is obtained; alternative processing activities; the sources and nature of risks to consumers (individually and broadly); measures and safeguards controllers must put into place; compliance with Rule 9.06 (Data Protection Assessment for Profiling) if the controller is processing personal data for profiling purposes; the details of the process implemented to ensure that personal data and sensitive data inferences are not transferred and deleted within 12 hours of the processing activity and the audit procedure for this process; the benefits for the processing that may flow to the controller, consumer and other expected stakeholders, and how these benefits outweigh the risks, relevant internal actors and external parties contributing the DPA; the DPA review process, and; dates the DPA was reviewed and approved, and names, positions, and signatures of the individuals responsible for the review and approval. These assessments must be reviewed and updated on an annual basis.

Profiling (Rule 9.03)

Businesses who engage in profiling must provide clear, understandable and transparent information in their privacy notices to help consumers understand how they are profiling the consumer. The proposed regulation provides a minimum of eight disclosure requirements for privacy notices, which include information such as: what decisions is subject to profiling; the categories of personal data that were or will be processed; what is the profiling process (in plain language); how profiling is relevant to the business; does the profiling serve for advertising purposes; if the profiling system has been evaluated for accuracy, fairness or bias; the benefits and consequences of such inferences, and; how consumers may opt out of the processing of personal data for profiling purposes.  

Next Steps

The comment period on the proposed rule began on October 10, 2022, and will end on February 1, 2023. The deadline for the Public Cost-Benefit Analysis Request is October 15, 2022. Once the comment period is over, a proposed rulemaking hearing will be held on February 1, 2023, at 10:00 am.

Written comments may be submitted by the following means:

Electronic: Comments may be submitted electronically by submitting this form.

Written and oral comments, attachments and associated contact information (e.g., phone, email, etc.) become part of the public record and are released here.