The Colorado Department of Law (“DoL”) has published a shortlist of potential universal opt-out mechanisms (“UOOMs”).  Beginning on July 1, 2024, companies will be required to allow consumers to opt out of the sale of their personal data or use of their personal data for targeted advertising using any UOOMs that are ultimately included in the final list.

The shortlist only includes three UOOMs:  OptOut Code, the Global Privacy Control (“GPC”), and Opt-Out Machine.  The inclusion of these three UOOMs likely signals the DoL’s desire to cover the spectrum of contexts in which sales or targeted ads likely arise.  Specifically, the GPC essentially operates as a do not track signal for website browsing, OptOut Code states that its UOOM function applies across a multitude of Internet of Things scenarios, and the Opt-Out Machine is email-based for more traditional data sales and data broker activities.  Notably, the GPC has been a requirement under the CCPA, which should be welcome news for businesses hoping for leverage their existing privacy program for CPA compliance.

The inclusion of these three UOOMs on the shortlist represents a creative approach by the DoL to address a practical reality—although the Colorado Privacy Act calls for a mechanism that universally opts a consumer out of all sales and targeted ads, that technology does not fully exist because targeted advertising cookies are usually not associated with the personally identifying information used for traditional data sales.  By selecting an UOOM that addresses these three different scenarios, the DoL is creating a structure that allows a consumer to universally opt out, even if it requires the use of three UOOMs rather than one.

Businesses and consumers now have until December 11, 2023, to submit additional feedback and comments on the shortlist, and the DoL must publish the final list by January 1, 2024. 

[View source.]