Universal Opt-Out Mechanism
The Colorado Privacy Act (CPA) contains express Consumer rights, including the rights of Colorado Consumers to opt out of the Sale of their Personal Data or use of their Personal Data for Targeted advertising – either directly with a business or using a Universal Opt-Out Mechanism (UOOM).
To ensure that Consumers and Controllers know which UOOMs will be enforced in Colorado, CPA Rule 5.07 explains that the Attorney General will “maintain a public list of Universal Opt-Out Mechanisms that have been recognized to meet the standards of this subsection,” and that the list “shall be released no later than January 1, 2024, and shall be updated periodically.”
Global Privacy Control (GPC)
The GPC was the first UOOM to be recognized to meet the standards of the CPA and CPA Rules.
The purpose of GPC is to provide Consumers with a simple and easy-to-use method by which they can automatically exercise their opt-out rights with all Controllers they interact with without having to make individuals requests with each controller. Currently, GPC is the only UOOM considered valid by The Department. For more information on GPC, visit globalprivacycontrol.org.
Universal Opt-Out List
The Colorado Department of Law (The Department) accepted applications for UOOMs from October 5 – November 6, 2023 and selected a narrow list of potential UOOMs for consideration (the “shortlist”). The Department accepted public comment on the shortlist of UOOMs and their accompanying applications through December 14, 2023. The Department considered public comments alongside each application and the criteria outlined in the UOOM application when deciding the final list. The applications and public comment can be found here.
The below list of UOOMs includes those The Department considers valid under the CPA and its regulations. The UOOMs on this list are recognized in so far as the UOOM or any authorized implementations meet the requirements of C.R.S. § 6-1-1313 and 4 CCR 904-3, Part 5. Organizations subject to the CPA can use the technical specification for each UOOM to ensure they are able to accept Consumer requests.
| Universal Opt-Out Mechanism | Technical Specification | Additional Information |
|---|---|---|
| Global Privacy Control (GPC) | Privacy CG | Website: Global Privacy Control |
| Global Privacy Control Implementation Guide |
The Department notes that this list does not exclude additional UOOMs from meeting the requirements of the CPA and its regulations now or in the future. This list represents the valid and recognized UOOMs that The Department will prioritize for enforcement. As noted in Rule 5.07, the list shall be updated periodically. The Department may update the list to include new UOOMs or remove UOOMs which are no longer compliant. When The Department updates the list, it will accept new applications and seek public comment. Sign up if you wish to receive updates related the CPA, UOOMs, or provide future rulemaking input. If you have questions or comments about the CPA or UOOMs, please submit them or email coprivacy@coag.gov.