United States of America: Opened consultation on Consumer Protection Section in Colorado Privacy Act Rules

On 10 October 2022, the Colorado Attorney General’s Office opened a consultation on the draft rules for the Consumer Protection Section under the draft Colorado Privacy Act Rules. Firstly, the draft provides definitions for personal data, including biometric data and lists "biometric identifiers," clarifying that unprocessed digital photographs and voice recordings will not fall within the scope of CPA. Secondly, the draft states that the controller will have to obtain consent for processing sensitive data, including data that would allow the controller to make "sensitive data inferences", such as the individual's race, religion, health information, sexual orientation or citizenship, and disclose such information upon user's request. Thirdly, the draft outlines the conditions under which controllers can process "sensitive data inferences" without consent. In particular, the processing would be classified as legal if the controllers delete the data within 12 hours and do not transfer or sell it to third parties. Finally, the draft specifies that entities cannot obtain user consent through dark patterns and outlines technical standards regarding the user interface design. The consultation closes on February 2023.