The Colorado Attorney General's office is poised to begin the rulemaking process for the Colorado Privacy Act (ColoPA).1 On January 28, 2022, Colorado Attorney General Phil Weiser issued prepared remarks outlining key rulemaking topics and announcing plans to seek input from Colorado consumers, businesses, and other stakeholders over the coming months. Although the ColoPA does not come into force until July 1, 2023, the Attorney General noted that his office "expect[s] to be in a position to adopt final rules around a year from now."
The ColoPA broadly authorizes the Attorney General to "promulgate rules for the purpose of carrying out" the law. The Attorney General must issue rules on certain topics by July 1, 2023, including rules that detail the technical specifications for one or more universal opt-out mechanisms. In his prepared remarks, Weiser identified three "big-picture issues [his office] will need to work through" during rulemaking:
- First, he noted that "the process of consumer notice and approval or rejection of data sharing needs to be conducted fairly, free from what some have called 'dark patterns,' which can unfairly mislead consumers on this issue." Importantly, the AG acknowledged that "California is adopting rules on this topic, and [Colorado] will need to look at this issue as well."
- Second, the Attorney General's office "will need to consider what the process will be for consumers to engage and learn about their data profiles as well as to correct inaccurate data."
- Third, he noted that ColoPA's "vision of company auditing and data protection assessment procedures is another area where [the Attorney General's office] might well want to provide guidance."
Weiser also offered a roadmap for the rulemaking process. The first phase of the process will involve soliciting comments from the public. The Attorney General's office will post a series of topics for informal input on its website and will solicit comments both in writing and at a series of meetings and town halls. The second phase will involve the formal rulemaking. Weiser anticipates posting a formal Notice of Proposed Rulemaking by Fall 2022, which will include a proposed set of model rules, and the public will then have an opportunity to provide verbal and written comments.
The Attorney General's remarks come on the heels of Wilson Sonsini Goodrich & Rosati's announcement that it is opening an office in Boulder, Colorado in the first quarter of 2022. The Boulder, Colorado office reinforces Wilson Sonsini's interest in expanding its life sciences and technology practice in that important market. The firm routinely helps companies navigate complex privacy and data security issues and will closely monitor the Attorney General's guidance regarding the ColoPA.
For more information or advice concerning the ColoPA, please contact Tracy Shapiro, Eddie Holman, Hale Melnick, Clinton Oxford, or any member of the firm's privacy and cybersecurity practice.
[1]We previously provided an overview of the ColoPA’s key requirements in a Wilson Sonsini alert, “Colorado Becomes Third State to Pass New General Privacy Law.”
