Colorado § 6-1-1313 - Rules - opt-out mechanism.

§ 6-1-1313. Rules - opt-out mechanism.

(1) The attorney general may promulgate rules for the purpose of carrying out this part 13.

(2) By July 1, 2023, the attorney general shall adopt rules that detail the technical specifications for one or more universal opt-out mechanisms that clearly communicate a consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B). The attorney general may update the rules that detail the technical specifications for the mechanisms from time to time to reflect the means by which consumers interact with controllers. The rules must:

(a) Not permit the manufacturer of a platform, browser, device, or any other product offering a universal opt-out mechanism to unfairly disadvantage another controller;

(b) Require controllers to inform consumers about the opt-out choices available under section 6-1-1306 (1)(a)(I);

(c) Not adopt a mechanism that is a default setting, but rather clearly represents the consumer's affirmative, freely given, and unambiguous choice to opt out of the processing of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B);

(d) Adopt a mechanism that is consumer-friendly, clearly described, and easy to use by the average consumer;

(e) Adopt a mechanism that is as consistent as possible with any other similar mechanism required by law or regulation in the United States; and

(f) Permit the controller to accurately authenticate the consumer as a resident of this state and determine that the mechanism represents a legitimate request to opt out of the processing of personal data for purposes of targeted advertising or the sale of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B).

(3) By January 1, 2025, the attorney general may adopt rules that govern the process of issuing opinion letters and interpretive guidance to develop an operational framework for business that includes a good faith reliance defense of an action that may otherwise constitute a violation of this part 13. The rules must become effective by July 1, 2025.

Source: L. 2021: Entire part added, (SB 21-190), ch. 483 p. 3464, § 1, effective July 1, 2023.