• by Wendy Davis  @wendyndavis, December 29, 2023

Starting in July, online ad companies won't be allowed to serve behaviorally targeted ads to Colorado residents who activate the Global Privacy Control -- a tool that aims to enable people to opt out of data-sharing for ad purposes -- the state attorney general said Friday.

Colorado's privacy law, passed in 2021, requires companies to allow state residents opt out of the processing of their personal data for ad targeting.

The measure defines personal data as including information that's “linked or reasonably linkable” to identified or identifiable individuals -- which covers much of the data used for personalized ads.

That law also requires companies to honor opt-out requests that consumers send via “user-enabled” controls, including browser settings or other mechanisms. Most provisions of the Colorado law took effect in July 2023, but the requirement to honor universal opt-out requests will not be effective until July.

Colorado regulations require the attorney general to post a list of user-enabled controls (referred to in the regulations as “universal opt-out mechanisms”) that companies will be required to honor. On Friday, state officials officially approved the Global Privacy Control -- a tool created by privacy advocates -- as the first of those mechanisms.

Ad-industry groups opposed the tool's approval, arguing that the Global Privacy Control didn't provide companies with enough information to determine whether a user was a Colorado resident.

The organizations argued that even if ad companies glean the IP addresses of people who activate the Global Privacy Control, IP addresses alone aren't sufficient to determine residency.

“Non-Colorado residents can easily access a Colorado IP address via a VPN,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance wrote in a December 11 letter to the Colorado Department of Law.

“In reality, IP addresses provide information related to the location from which a consumer may be accessing the internet at a particular point in time. Such information is not indicative of residency, as consumers travel across state lines often and may access the internet from nearly any state or country in the world.”