On March 15, 2023, the Colorado Attorney General filed final rules implementing the Colorado Privacy Act (“CPA”) with the Secretary of State.  The Attorney General first released proposed draft rules on October 10, 2022 and subsequently released revised draft rules on December 21, 2022 and January 27, 2023 after public comment.  The final rules will go into effect July 1, 2023.

A few highlights in the final rules are as follows:

  • Data Minimization.  The final rules require controllers to delete (or otherwise anonymize or render inaccessible) sensitive data within a reasonable amount of time after the consumer withdraws consent (as applicable).  The final rules also require controllers to review the following data annually to determine if storage is still necessary, adequate, or relevant to the express processing purpose: Biometric Identifiers (which is a new, defined term in the rules), photographs, audio or voice records, and personal data generated from such photographs or recordings.
  • Refreshing Consent.  The final rules require controllers to “refresh consent” for processing sensitive data and certain secondary processing involving profiling that results in decisions that produce legal or similarly significant effects.  However, the final rules clarify that this requirement does not apply if the controller has interacted with the consumer in the prior 24 months.  Controllers also do not need to refresh consent if a user is able to update their opt-out preferences at any time via a user interface.
  • Dark Patterns.  The final rules clarify that the principles related to dark patterns apply only in circumstances where the controller is required to obtain consent and provide a list of “factors to be considered” when evaluating if a user interface or choice architecture “has been designed or manipulated with the substantial effect of” impairing user autonomy.  These factors include whether consent choices are presented in a symmetrical way, use “emotionally manipulative language or visuals,” or present consent with a preselected option.
  • Consumer Rights.  The final rules set forth requirements for facilitating consumer rights of access, deletion, correction, and opt-out requests.  For example, if authenticating a consumer’s request requires more than “commercially reasonable efforts,” the controller can decline to honor the consumer’s request.
  • Universal Opt-Out Mechanism.  The final rules note that a universal opt-out mechanism may express a consumer’s choices with respect to either, or both, targeted advertising or sales.  Platforms, developers, or providers of universal opt-out mechanisms must provide a privacy notice, which, among other things, must clearly describe any limits of the universal opt-out mechanism. 
  • Profiling.  The final rules permit controllers to decline a request to opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, if the profiling is based on processing in which a human (1) considers the relevant data or output and (2) can change or influence the outcome.  However, if the controller decides not to take action on a request to opt-out, it must provide certain information in its privacy notice, including a “non-technical, plain language explanation of the role of meaningful human involvement in Profiling and the decision-making process,” how consumers can delete or correct personal data used for profiling, and a plain language explanation of the “logic used in the Profiling process.” 
Print:
Email this postTweet this postLike this postShare this post on LinkedIn
Photo of Jorge Ortiz Jorge Ortiz

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related…

Jorge Ortiz is an associate in the firm’s Washington, DC office and a member of the Data Privacy and Cybersecurity and the Technology and Communications Regulation Practice Groups.

Jorge advises clients on a broad range of privacy and cybersecurity issues, including topics related to privacy policies and compliance obligations under U.S. state privacy regulations like the California Consumer Privacy Act.

Photo of Jayne Ponder Jayne Ponder

Jayne Ponder provides strategic advice to national and multinational companies across industries on existing and emerging data privacy, cybersecurity, and artificial intelligence laws and regulations.

Jayne’s practice focuses on helping clients launch and improve products and services that involve laws governing data privacy…

Jayne Ponder provides strategic advice to national and multinational companies across industries on existing and emerging data privacy, cybersecurity, and artificial intelligence laws and regulations.

Jayne’s practice focuses on helping clients launch and improve products and services that involve laws governing data privacy, artificial intelligence, sensitive data and biometrics, marketing and online advertising, connected devices, and social media. For example, Jayne regularly advises clients on the California Consumer Privacy Act, Colorado AI Act, and the developing patchwork of U.S. state data privacy and artificial intelligence laws. She advises clients on drafting consumer notices, designing consent flows and consumer choices, drafting and negotiating commercial terms, building consumer rights processes, and undertaking data protection impact assessments. In addition, she routinely partners with clients on the development of risk-based privacy and artificial intelligence governance programs that reflect the dynamic regulatory environment and incorporate practical mitigation measures.

Jayne routinely represents clients in enforcement actions brought by the Federal Trade Commission and state attorneys general, particularly in areas related to data privacy, artificial intelligence, advertising, and cybersecurity. Additionally, she helps clients to advance advocacy in rulemaking processes led by federal and state regulators on data privacy, cybersecurity, and artificial intelligence topics.

As part of her practice, Jayne also advises companies on cybersecurity incident preparedness and response, including by drafting, revising, and testing incident response plans, conducting cybersecurity gap assessments, engaging vendors, and analyzing obligations under breach notification laws following an incident.

Jayne maintains an active pro bono practice, including assisting small and nonprofit entities with data privacy topics and elder estate planning.

Photo of Libbie Canter Libbie Canter

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws.

Libbie Canter represents a wide variety of multinational companies on managing privacy, cyber security, and artificial intelligence risks, including helping clients with their most complex privacy challenges and the development of governance frameworks and processes to comply with U.S. and global privacy laws. She routinely supports clients on their efforts to launch new products and services involving emerging technologies, and she has assisted dozens of clients with their efforts to prepare for and comply with federal and state laws, including the California Consumer Privacy Act, the Colorado AI Act, and other state laws. As part of her practice, she also regularly represents clients in strategic transactions involving personal data, cybersecurity, and artificial intelligence risk and represents clients in enforcement and litigation postures.

Libbie represents clients across industries, but she also has deep expertise in advising clients in highly-regulated sectors, including financial services and digital health companies. She counsels these companies — and their technology and advertising partners — on how to address legacy regulatory issues and the cutting edge issues that have emerged with industry innovations and data collaborations. 

Chambers USA 2024 ranks Libbie in Band 3 Nationwide for both Privacy & Data Security: Privacy and Privacy & Data Security: Healthcare. Chambers USA notes, Libbie is “incredibly sharp and really thorough. She can do the nitty-gritty, in-the-weeds legal work incredibly well but she also can think of a bigger-picture business context and help to think through practical solutions.”

Photo of Lindsey Tonsager Lindsey Tonsager

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection…

Lindsey Tonsager co-chairs the firm’s global Data Privacy and Cybersecurity practice. She advises clients in their strategic and proactive engagement with the Federal Trade Commission, the U.S. Congress, the California Privacy Protection Agency, and state attorneys general on proposed changes to data protection laws, and regularly represents clients in responding to investigations and enforcement actions involving their privacy and information security practices.

Lindsey’s practice focuses on helping clients launch new products and services that implicate the laws governing the use of artificial intelligence, data processing for connected devices, biometrics, online advertising, endorsements and testimonials in advertising and social media, the collection of personal information from children and students online, e-mail marketing, disclosures of video viewing information, and new technologies.

Lindsey also assesses privacy and data security risks in complex corporate transactions where personal data is a critical asset or data processing risks are otherwise material. In light of a dynamic regulatory environment where new state, federal, and international data protection laws are always on the horizon and enforcement priorities are shifting, she focuses on designing risk-based, global privacy programs for clients that can keep pace with evolving legal requirements and efficiently leverage the clients’ existing privacy policies and practices. She conducts data protection assessments to benchmark against legal requirements and industry trends and proposes practical risk mitigation measures.