United States of America: Opened consultation on revised draft of Consumer Protection Section in Colorado Privacy Act Rules

On 21 December 2022, the Colorado Attorney General (AG) opened the public consultation on the revised draft of the Colorado Privacy Act Rules until 1 February 2023. The new draft contains updated provisions following the comments received from the previous consultation. The stakeholders are invited to submit comments and provide additional information on the five revised sections of the Rules concerning consumer protection. Firstly, the AG aims to gather additional information on the definitions of employer, employee, and employment records, the distinction between commercial and non-commercial products and services, and the definition of loyalty programs. Secondly, stakeholders are asked about ways to authenticate users' physical location, with specific regard to the use of IP addresses. Thirdly, concerning the universal opt-out mechanism mentioned in the rules, the AG asks whether it needs to be defined immediately or if the specifics can be deferred to a collaborative process with stakeholders. The fourth issue is the difference between the provisions originally foreseen by Colorado AG regarding the obligation for controllers to provide consumers with purpose-based privacy notices and the California Privacy Notice requirements. In this regard, the AG solicits comments aimed at increasing interoperability between the two States' legal regimes. Finally, the focus is brought back to loyalty programs and their connection to the sale of consumers' personal data.