Denver, Colo. — Governor Jared Polis signed the Colorado Privacy Act into law on July 7. The bill (SB 12-190) provides consumers with the right to access, delete, and stop the sale of their personal information, and requires consent for processing sensitive information. Colorado is now the third state, after California and Virginia, to ratify a commercial privacy law.
Consumer Reports said the CPA is a step in the right direction for consumer privacy, and it improves upon the Virginia law passed earlier this year in several key ways:
- The bill requires companies to honor browser privacy signals, such as the Global Privacy Control, in order to opt out of data sales at all companies in a single step
- It requires companies to honor opt out requests submitted by agents designated on the consumer’s behalf
- It prohibits the use of so-called “dark patterns” in obtaining consent to process sensitive information
- The bill has stronger enforcement, by placing a sunset on the “right to cure” in administrative enforcement, so that after 2025 companies will no longer have a “get out of jail free” card for failing to protect consumer privacy
“We are excited about the progress Colorado is making on privacy,” said Maureen Mahoney, senior policy analyst at Consumer Reports. “Lawmakers in Colorado have taken an important step in advancing privacy rights for their citizens, and we hope this serves as an example for other states to follow. But there still remains work to be done, and we urge the legislature to return next year to strengthen the bill before it goes into effect, so that it is at least as strong as the California law.”
CR recommends several additional improvements to the bill to ensure that it adequately protects consumers’ privacy. Chief among these is closing potential loopholes for targeted advertising, in light of industry’s bad-faith interpretation of the even stronger California law — claiming that the opt out doesn’t apply to data shared with third parties for targeted advertising (California’s Proposition 24 closes up the loopholes that industry has exploited in the state, but it does not fully go into effect until 2023).
CR said the Colorado law should also have included consensus language from the Washington Privacy Act proposed in Washington state, which would ensure that consumers can’t be charged for exercising their privacy rights, to ensure that consumers have a meaningful choice in protecting their privacy.
The Colorado Privacy Act is scheduled to go into effect on July 1, 2023.
Contact: David Butler, david.butler@consumer.org