On March 15, 2023, the Colorado Attorney General filed final rules implementing the Colorado Privacy Act (“CPA”) with the Secretary of State.  The Attorney General first released proposed draft rules on October 10, 2022 and subsequently released revised draft rules on December 21, 2022 and January 27, 2023 after public comment.  The final rules will go into effect July 1, 2023.

A few highlights in the final rules are as follows:

• Data Minimization.  The final rules require controllers to delete (or otherwise anonymize or render inaccessible) sensitive data within a reasonable amount of time after the consumer withdraws consent (as applicable).  The final rules also require controllers to review the following data annually to determine if storage is still necessary, adequate, or relevant to the express processing purpose: Biometric Identifiers (which is a new, defined term in the rules), photographs, audio or voice records, and personal data generated from such photographs or recordings.
• Refreshing Consent.  The final rules require controllers to “refresh consent” for processing sensitive data and certain secondary processing involving profiling that results in decisions that produce legal or similarly significant effects.  However, the final rules clarify that this requirement does not apply if the controller has interacted with the consumer in the prior 24 months.  Controllers also do not need to refresh consent if a user is able to update their opt-out preferences at any time via a user interface.
• Dark Patterns.  The final rules clarify that the principles related to dark patterns apply only in circumstances where the controller is required to obtain consent and provide a list of “factors to be considered” when evaluating if a user interface or choice architecture “has been designed or manipulated with the substantial effect of” impairing user autonomy.  These factors include whether consent choices are presented in a symmetrical way, use “emotionally manipulative language or visuals,” or present consent with a preselected option.
• Consumer Rights.  The final rules set forth requirements for facilitating consumer rights of access, deletion, correction, and opt-out requests.  For example, if authenticating a consumer’s request requires more than “commercially reasonable efforts,” the controller can decline to honor the consumer’s request.
• Universal Opt-Out Mechanism.  The final rules note that a universal opt-out mechanism may express a consumer’s choices with respect to either, or both, targeted advertising or sales.  Platforms, developers, or providers of universal opt-out mechanisms must provide a privacy notice, which, among other things, must clearly describe any limits of the universal opt-out mechanism. 
• Profiling.  The final rules permit controllers to decline a request to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, if the profiling is based on processing in which a human (1) considers the relevant data or output and (2) can change or influence the outcome.  However, if the controller decides not to take action on a request to opt-out, it must provide certain information in its privacy notice, including a “non-technical, plain language explanation of the role of meaningful human involvement in Profiling and the decision-making process,” how consumers can delete or correct personal data used for profiling, and a plain language explanation of the “logic used in the Profiling process.”