CDT Comments on Global Privacy Control and Colorado’s Universal Opt-Out Mechanisms

This week, CDT filed comments with the Colorado Attorney General regarding Colorado’s recognition of universal opt-out mechanisms as described by the Colorado Privacy Act. The 2021 law grants Colorado consumers important new rights with respect to their personal data, including the right to access, delete, and correct their personal data as well as the right to opt out of the sale of their personal data or its use for targeted advertising or certain kinds of profiling. 

However, it is impossible for consumers to keep track of every piece of software and every company they interact with on the web. To enjoy their rights under the CPA, Coloradans need privacy tools that help them automatically communicate their data privacy preferences to the websites they visit. Such opt-out control mechanisms should be standardized, to ease adoption by industry and to facilitate effective choices by consumers. The Global Privacy Control (GPC) is one such browser setting that allows a user to communicate their preference – and to exercise their legal rights – to opt out of sharing and sale of their personal information.

CDT strongly recommends that Colorado recognize GPC as a universal opt-out mechanism. We are encouraged to see incubation and standardization of the Global Privacy Control ongoing at the World Wide Web Consortium (W3C). W3C is an open, multistakeholder standard-setting body and the standardization process enables vetting for the design, especially to ensure its interoperability across browsers and websites. The Colorado Department of Law can aid this effort in collaborating with other regulatory bodies in providing guidance to the standardization process.

Read the full comments.