Denver, Colo. — Today, the Colorado legislature approved privacy legislation that would give residents the right to access, delete, and stop the sale of their personal information, with additional protections for sensitive data. Colorado is the third state to advance comprehensive privacy legislation, after California and Virginia. The bill now heads to Governor Jared Polis for his consideration. If approved, the law would go into effect on July 1, 2023.
The bill includes key provisions, including a requirement that companies honor browser privacy signals as a global opt out of sale, so that consumers can stop the sale of their information from all companies in a single step. The measure also allows consumers to delegate to third parties, known as authorized agents, the ability to stop the sale of their personal information on their behalf. Further, the bill prohibits the use of dark patterns, deceptive interfaces that push consumers into taking steps that they did not intend, in obtaining consent to process information, and places a sunset on the “right to cure” provision in administrative enforcement.
“We commend Colorado legislators for including provisions in the Colorado Privacy Act that will make it easier for residents to take control of their personal information,” said Maureen Mahoney, senior policy analyst at Consumer Reports. “If the governor approves the bill, we urge the legislature to strengthen it in the future, including by clarifying that consumers can’t be charged for exercising their privacy rights.”
While the U.S. Congress has stalled in introducing a comprehensive privacy law to protect the privacy of all Americans this year, over a dozen states have considered legislation, similar to the California Consumer Privacy Act (CCPA), that would extend baseline privacy rights to consumers. Legislatures in New York, Massachusetts, and Connecticut have pending privacy bills that are being considered in their respective states.
Contact: Cyrus Rassool, cyrus.rassool@consumer.org