On December 29, 2023, the Colorado Attorney General (the “AG”) announced that the Global Privacy Control (“GPC”) will become the first universal opt-out mechanism (“UOOM”) the AG considers valid under the Colorado Privacy Act (the “CPA”).  Effective July 1, 2024, controllers subject to the CPA will need to treat Colorado consumers’ privacy preferences submitted through browser signals that conform to the GPC specification as consumers’ requests to opt out of data sale or targeted advertising.

The CPA requires controllers to process UOOMs that meet certain technical specifications under the CPA as consumers’ formal requests to opt out, similar to the California Consumer Privacy Act’s requirement for businesses to honor opt-out preference signals.  To help consumers and controllers understand which UOOMs meet such specifications, the CPA requires the AG to publish and maintain a public list of UOOMs that controllers must detect and process.  After publishing a shortlist of potentially valid UOOMs, the AG announced that GPC will be the first – and currently the only – UOOM the AG will recognize.

The AG’s announcement emphasized that the Colorado Department of Law (the “DOL”) will periodically update the list to include other UOOMs that meet the CPA’s criteria.  When the DOL adds another UOOM to the list, controllers will have six (6) months to detect and comply with such new UOOM.

Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to provide updates on notable developments surrounding federal and state privacy laws, including issues related to UOOMs. 

[View source.]