Articles

02Feb

Clarifications from Colorado Attorney General Would Ease Insights Industry Compliance with Colorado Privacy Act

With Colorado’s new comprehensive privacy law coming into effect this summer, the Insights Association called for clarifications in the proposed rules to aid compliance by the insights industry.

The Colorado Privacy Act, enacted in 2021, comes into effect on July 1, 2023. The Act adds consumer privacy rights, requires privacy notices, opt in to process sensitive data, data protection assessments for high-risk processing activities, and data processing agreements, among other things. The law has similarities to, but by no means meshes perfectly with, other state privacy laws becoming effective this year. The state Attorney General (AG) recently released a third draft of regulations implementing the Act, but has been working on rules since last fall.

In comments filed with the state Attorney General (AG) on January 31, 2023, the Insights Association asked for clarification that the exception from the definition of “targeted advertising” in the Act covers both internal first-party audience measurement and independent audience measurement, for all kinds of content (not just advertising).

“Audience measurement, particularly independent audience measurement, builds the currency upon which advertising and other content, online and off, is valued, and collects covered data about individuals for the purpose of understanding groups,” IA said.

IA also called upon the AG to determine which opt out mechanism will be recognized for the Colorado Privacy Act now, taking “into account the cost of implementing such mechanisms, and which mechanisms are presently being offered in the market as stand-alone technology solutions (rather than components of a larger package) to help medium- and smaller-sized businesses comply.”

Further, the Insights Association strongly urged the AG “to continue to draft rules so that separate privacy policies and even stand-alone, state-specific sections within a given privacy policy are not required.” With already “five different state consumer privacy laws in effect across the United States” by the end of 2023, IA observed that “[a] proliferation of state state-specific notices and disclosures will confuse consumers and not meaningfully further consumer privacy.”

IA also asked the AG to clarify that the same verbiage required by the California Privacy Rights Act (CPRA) as the text for an opt-out link would satisfy the Colorado regulations in place of the AG’s proposed examples (“Colorado Opt-Out Rights,” “Personal Data Use Opt-Out,” and “Your Opt-Out Rights”).

In addition, the Insights Association urged the AG to clarify that “where a research subject provides sensitive data (e.g., demographic information concerning race/ethnicity) as part of a market research study, it would be ‘obvious’ that such sensitive data is going to be processed for research purposes, including without limitation to provide research clients with insights into the preferences of specific demographic groups.”

Finally, IA asked that the designation of a consumer’s authorized agent for submitting requests under the Act be limited “to minors, and elderly or incapacitated individuals.”

The Insights Association will continue to pursue a comprehensive federal privacy law most conducive to insights, while preempting the patchwork of state laws. In the meantime, insights companies and organizations need to do everything they can to comply with these laws, and IA hopes that the clarifications requested from the Colorado Attorney General will make such compliance easier in Colorado.

-- IA comments on the Colorado Privacy Act (1/31/23)

About the Author

Howard Fienberg

Howard Fienberg

Based in Washington, DC, Howard is the Insights Association's lobbyist for the marketing research and data analytics industry, focusing primarily on consumer privacy and data security, the Telephone Consumer Protection Act (TCPA), tort reform, and the funding and integrity of the decennial Census and the American Community Survey (ACS). Howard has more than two decades of public policy experience. Before the Insights Association, he worked in Congress as senior legislative staffer for then-Representatives Christopher Cox (CA-48) and Cliff Stearns (FL-06). He also served more than four years with a science policy think tank, working to improve the understanding of scientific and social research and methodology among journalists and policymakers. Howard is also co-director of The Census Project, a 900+ member coalition in support of a fair and accurate Census and ACS. He has also served previously on the Board of Directors for the National Institute for Lobbying and Ethics and and the Association of Government Relations Professionals. Howard has an MA International Relations from the University of Essex in England and a BA Honors Political Studies from Trent University in Canada, and has obtained the Certified Association Executive (CAE), Professional Lobbying Certificate (PLC) and the Public Policy Certificate (PPC). When not running advocacy for the Insights Association, Howard enjoys hockey, NFL football, sci-fi and horror movies, playing with his dog, and spending time with family and friends.

Attachments

Related

Fighting for You: March 2023 Legislative & Regulatory Update

Fighting for You: March 2023 Legislative & Regulatory Update

Welcome to spring, where the insights industry has been facing challenges in regulation and legislat...

Read More >
California Considering Yet More CPRA Rules for Cybersecurity Audits, Risk Assessments and Automated Decisionmaking

California Considering Yet More CPRA Rules for Cybersecurity Audits, Risk Assessments and Automated Decisionmaking

Even before the ink is dry on the regulations implementing the new California Privacy Rights Act (CP...

Read More >
Final CPRA Regulations Will Hit by Summer 2023 Enforcement Deadline

Final CPRA Regulations Will Hit by Summer 2023 Enforcement Deadline

​​​​​​​The final rules implementing the California Privacy Rights Act (CPRA) should come into...

Read More >
California A.B. 947 Would Make Citizenship and Immigration Status Sensitive Data

California A.B. 947 Would Make Citizenship and Immigration Status Sensitive Data

​​​​​​​California Assemblymember Jesse Gabriel (D-46) introduced A.B. 947, legislation that w...

Read More >
Washington My Health My Data Act - H.B. 1155 and S.B. 5351

Washington My Health My Data Act - H.B. 1155 and S.B. 5351

Washington Rep.  Vandana Slatter (D-48) introduced the Washington My Health My Data Act (H.B. 1155, ...

Read More >
NTIA Exploring How Data Practices Affect Civil Rights

NTIA Exploring How Data Practices Affect Civil Rights

In response to a federal inquiry into privacy, equity and civil rights, Privacy for America urged “...

Read More >
Members only Article - Please login to view