EPIC Urges Colorado AG to Draft Strong and Protective Rules Implementing the Colorado Privacy Act

EPIC submitted comments to the Colorado Attorney General today as they promulgate rules implementing key measures of the Colorado Privacy Act. Specifically, EPIC urges Colorado to:

• Set out clear standards for personal data collection, use, and transfer that restrict behavioral tracking and secondary uses of data;
• Broadly define “dark patterns” and include a non-exhaustive list of manipulative design tactics in order to curb abuse and aid enforcement;
• Establish a universal opt-out mechanism that makes it easy for individuals to limit the collection, use, and transfer of their data;
• Narrowly scope the definition of affirmative, freely given, and specific consent;
• Empower individuals to meaningfully exercise their right to opt-out of profiling and automated decision making; and
• Define minimum requirements for robust Data Protection Impact Assessments that enable comparative and objective review by both enforcement authorities and consumers.

EPIC advocates for the passage of comprehensive baseline privacy laws, like the American Data Privacy and Protection Act. EPIC Counsel Ben Winters testified during an open meeting of the Colorado Attorney General on the rule-making earlier this year, and EPIC submitted comments to both California and Colorado Privacy Law rule-makings.