The Colorado Privacy Act (CPA) contains express Consumer rights, including the rights of Colorado Consumers to opt out of the Sale of Personal Data and the Processing of Personal Data for Targeted Advertising. Beginning on July 1, 2024, organizations that fall within the CPA’s application thresholds must allow Consumers to opt-out of the Sale of their Personal Data or use of their Personal Data for Targeted Advertising using a Universal Opt-Out Mechanism (UOOM).
To ensure that Consumers and Controllers know which UOOMs will be enforced in Colorado, CPA Rule 5.07 explains that the Attorney General will “maintain a public list of Universal Opt-Out Mechanisms that have been recognized to meet the standards of this subsection,” and that the list “shall be released no later than January 1, 2024, and shall be updated periodically.”
The Colorado Department of Law (The Department) accepted applications for UOOMs from October 5 – November 6, 2023 and selected a narrow list of potential UOOMs for consideration (the “shortlist”). The Department accepted public comment on the shortlist of UOOMs and their accompanying applications through December 14, 2023. The Department considered public comments alongside each application and the criteria outlined in the UOOM application when deciding the final list. The applications and public comment can be found here.
The below list of UOOMs includes those The Department considers valid under the CPA and its regulations. The UOOMs on this list are recognized in so far as the UOOM or any authorized implementations meet the requirements of C.R.S. § 6-1-1313 and 4 CCR 904-3, Part 5. Organizations subject to the CPA can use the technical specification for each UOOM to ensure they are able to accept Consumer requests.
| Universal Opt-Out Mechanism | Technical Specification | Additional Information |
|---|---|---|
| Global Privacy Control (GPC) | Privacy CG | Website: Global Privacy Control |
| Global Privacy Control Implementation Guide |
The Department notes that this list does not exclude additional UOOMs from meeting the requirements of the CPA and its regulations now or in the future. This list represents the valid and recognized UOOMs that The Department will prioritize for enforcement. As noted in Rule 5.07, the list shall be updated periodically. The Department may update the list to include new UOOMs or remove UOOMs which are no longer compliant. When The Department updates the list, it will accept new applications and seek public comment. If you wish to receive updates related the CPA, UOOMs, or provide future rulemaking input, please click here. If you have questions or comments about the CPA or UOOMs, please submit them here or email coprivacy@coag.gov.