Clarifications from Colorado Attorney General Would Ease Insights Industry Compliance with Colorado Privacy Act - Articles

Articles

02Feb

Clarifications from Colorado Attorney General Would Ease Insights Industry Compliance with Colorado Privacy Act

With Colorado’s new comprehensive privacy law coming into effect this summer, the Insights Association called for clarifications in the proposed rules to aid compliance by the insights industry.

The Colorado Privacy Act, enacted in 2021, comes into effect on July 1, 2023. The Act adds consumer privacy rights, requires privacy notices, opt in to process sensitive data, data protection assessments for high-risk processing activities, and data processing agreements, among other things. The law has similarities to, but by no means meshes perfectly with, other state privacy laws becoming effective this year. The state Attorney General (AG) recently released a third draft of regulations implementing the Act, but has been working on rules since last fall.

In comments filed with the state Attorney General (AG) on January 31, 2023, the Insights Association asked for clarification that the exception from the definition of “targeted advertising” in the Act covers both internal first-party audience measurement and independent audience measurement, for all kinds of content (not just advertising).

“Audience measurement, particularly independent audience measurement, builds the currency upon which advertising and other content, online and off, is valued, and collects covered data about individuals for the purpose of understanding groups,” IA said.

IA also called upon the AG to determine which opt out mechanism will be recognized for the Colorado Privacy Act now, taking “into account the cost of implementing such mechanisms, and which mechanisms are presently being offered in the market as stand-alone technology solutions (rather than components of a larger package) to help medium- and smaller-sized businesses comply.”

Further, the Insights Association strongly urged the AG “to continue to draft rules so that separate privacy policies and even stand-alone, state-specific sections within a given privacy policy are not required.” With already “five different state consumer privacy laws in effect across the United States” by the end of 2023, IA observed that “[a] proliferation of state state-specific notices and disclosures will confuse consumers and not meaningfully further consumer privacy.”

IA also asked the AG to clarify that the same verbiage required by the California Privacy Rights Act (CPRA) as the text for an opt-out link would satisfy the Colorado regulations in place of the AG’s proposed examples (“Colorado Opt-Out Rights,” “Personal Data Use Opt-Out,” and “Your Opt-Out Rights”).

In addition, the Insights Association urged the AG to clarify that “where a research subject provides sensitive data (e.g., demographic information concerning race/ethnicity) as part of a market research study, it would be ‘obvious’ that such sensitive data is going to be processed for research purposes, including without limitation to provide research clients with insights into the preferences of specific demographic groups.”

Finally, IA asked that the designation of a consumer’s authorized agent for submitting requests under the Act be limited “to minors, and elderly or incapacitated individuals.”

The Insights Association will continue to pursue a comprehensive federal privacy law most conducive to insights, while preempting the patchwork of state laws. In the meantime, insights companies and organizations need to do everything they can to comply with these laws, and IA hopes that the clarifications requested from the Colorado Attorney General will make such compliance easier in Colorado.

-- IA comments on the Colorado Privacy Act (1/31/23)

About the Author

Howard Fienberg

Howard Fienberg

Based in Washington, DC, Howard is the Insights Association's lobbyist for the marketing research and data analytics industry, focusing primarily on consumer privacy and data security, the Telephone Consumer Protection Act (TCPA), tort reform, and the funding and integrity of the decennial Census and the American Community Survey (ACS). Howard has more than two decades of public policy experience. Before the Insights Association, he worked in Congress as senior legislative staffer for then-Representatives Christopher Cox (CA-48) and Cliff Stearns (FL-06). He also served more than four years with a science policy think tank, working to improve the understanding of scientific and social research and methodology among journalists and policymakers. Howard is also co-director of The Census Project, a 900+ member coalition in support of a fair and accurate Census and ACS. He has also served previously on the Board of Directors for the National Institute for Lobbying and Ethics and and the Association of Government Relations Professionals. Howard has an MA International Relations from the University of Essex in England and a BA Honors Political Studies from Trent University in Canada, and has obtained the Certified Association Executive (CAE), Professional Lobbying Certificate (PLC) and the Public Policy Certificate (PPC). When not running advocacy for the Insights Association, Howard enjoys hockey, NFL football, sci-fi and horror movies, playing with his dog, and spending time with family and friends.

Attachments

Related

California A.B. 1008 Would Impede Data Mining

California A.B. 1008 Would Impede Data Mining

California A.B. 1008 would redefine what is considered “publicly available” under the California ...

Read More >
CPPA Preparing Rules for Centralized Data Broker Deletion Mechanism

CPPA Preparing Rules for Centralized Data Broker Deletion Mechanism

While the California Privacy Protection Agency (CPPA) hasn’t yet issued rules to implement last yea...

Read More >
California A.B. 1949 Would Dramatically Expand Minors Privacy Restrictions

California A.B. 1949 Would Dramatically Expand Minors Privacy Restrictions

California A.B. 1949 would require affirmative consent (opt in) for the collection, sharing, sale, o...

Read More >
KOSA Passes House Subcommittee

KOSA Passes House Subcommittee

The House Innovation, Data and Commerce Subcommittee approved the Kids Online Safety Act (KOSA) (H.R...

Read More >
APRA Privacy Bill Passes House Subcommittee in New Form

APRA Privacy Bill Passes House Subcommittee in New Form

The American Privacy Rights Act (APRA), comprehensive federal privacy legislation, advanced out of a...

Read More >
Fighting for You: May 2024 Legislative and Regulatory Update

Fighting for You: May 2024 Legislative and Regulatory Update

With summer almost upon us, the Insights Association focused this month on a new U.S. law prohibitin...

Read More >
Members only Article - Please login to view