On April 12, at the International Association of Privacy Professionals’ global privacy conference, Colorado Attorney General Phil Weiser gave remarks on his office’s approach to the rulemaking and enforcement of the Colorado Privacy Act.

Attorney General Weiser observed that his office’s approach will be “principle-based” and not prescriptive.  He shared that promulgating too many specific rules could be counterproductive.  Not only would they not serve every context, he stated that also they could create challenges of interoperability if other states also are very prescriptive.  The Attorney General invited suggestions for how his office might approach three areas in particular during the rulemaking:

  • Technical specifications for the universal opt-out mechanisms, including “protocols or templates for such mechanisms” and how to ensure they are interoperable with other state requirements;
  • Principles that may be used to identify and regulate “dark patterns,” including which user interface design choices may impair consumer autonomy or impact consumer choice, whether the rules should prohibit specific types of dark patterns, and if there are specific frameworks or tools already in existence that help identify dark patterns; and
  • What constitutes an appropriate data protection assessment from a substantive and procedural standpoint.

In addition to the issues he specifically addressed in these remarks, the Colorado Attorney General Office released the Pre-Rulemaking Considerations for the Colorado Privacy Act.  This document outlines a number of other areas of interest, including (1) standards for consent and how consent is obtained; (2) profiling and automated decision making that produce “legal or similarly significant effects” and consumer choice to opt out; (3) how the Attorney General should issue opinion letters and interpretive guidance; (4) offline and off-web collection of data; and (5) how to avoid “consumer confusion and compliance conflicts” based on differences between the CPA and other state laws.

Attorney General Weiser also described factors that might be relevant to enforcement.  For example, he explained he would consider whether an alleged violator made a strategic decision to not comply with the CPA despite understanding its obligations, or if it lacked the resources or maturity to do so.  He also said his office would consider the particular area of noncompliance and whether it is a “consumer pain point,” or an issue that has received a large volume of complaints from Colorado residents.  He shared that he would not take litigation action without first discussing with an alleged violator whether they want to bring themselves back into compliance.  The CPA does provide a 60-day cure period, which will be repealed on January 1, 2025.

 

Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Andrew Longhi Andrew Longhi

Andrew Longhi is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and Technology and Communications Regulation Practice Groups.

Andrew advises clients on a broad range of privacy and cybersecurity issues, including compliance obligations, commercial…

Andrew Longhi is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and Technology and Communications Regulation Practice Groups.

Andrew advises clients on a broad range of privacy and cybersecurity issues, including compliance obligations, commercial transactions involving personal information and cybersecurity risk, and responses to regulatory inquiries.

Andrew is Admitted to the Bar under DC App. R. 46-A (Emergency Examination Waiver); Practice Supervised by DC Bar members.

Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports…

Libbie Canter represents a wide variety of multinational companies on privacy, cyber security, and technology transaction issues, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state privacy laws, including the California Consumer Privacy Act and California Privacy Rights Act.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations.