In anticipation of July 1, 2024, requirements to allow consumers the ability to use “universal opt out mechanisms” in certain circumstances, Colorado has posted its “universal opt out shortlist.” The list is indeed short. Only one mechanism, the already-known global privacy control (GPC) is on it. The Colorado Attorney General has indicated that the list can be updated. And it may be in the coming months.

As most are no doubt already aware, the Colorado privacy law requires, among other things, that covered companies let website users opt out of having their personal information sold or used for targeted advertising. To exercise these rights, companies need to -beginning July 1 of this year- allow consumers to make their choices using a listed mechanism (also referred to as a UOOM). The regulations to the law, finalized last year, require that the Colorado AG maintain a public list of UOOMs, which list it must update “periodically.”

Putting It Into Practice: Companies who are subject to California’s privacy law will already be familiar with GPC, and the UOOM obligations. Thus while the obligation is not new, this Colorado website is. In addition to bookmarking this site (and regularly visit to see if other mechanism are added), now may also be the time to review your company’s targeted advertising activities, and to asses if your company’s current activities bring this law -or other state privacy laws- into scope.