• by Wendy Davis  @wendyndavis, June 8, 2021

Colorado lawmakers Tuesday passed a privacy bill that would require companies to honor consumers' requests to opt out of targeted advertising -- including requests consumers make through browser settings or other global mechanisms.

The bill was unanimously approved Tuesday by the state Senate, after passing in the House Monday by a vote of 57-7 Monday. The measure now heads to Gov. Jared Polis.

Should Polis sign the bill, Colorado will join California and Virginia in giving state residents the right to eschew at least some forms of targeted ads. 

Specifically, the proposed "Protect Personal Data Privacy" (SB 21-190) would require companies to allow state residents opt out of the processing of their personal data for ad targeting.

The measure defines personal data as information “linked or reasonably linkable” to identified or identifiable individuals, which would cover much of the data that ad-tech companies draw on for ad personalization.

The proposed law would also require companies to obtain people's express consent before processing sensitive data -- including information that reveals race, ethnicity, religious beliefs, health conditions, citizenship status and sexual orientation.

Targeted ads are defined in the bill as ads based on personal data obtained or inferred from consumers' activities across non-affiliated sites, applications and services.

The definition excludes ads that are served to people based on their activity “within a controller's own websites or online applications.”

The opt-out provisions additionally require companies to honor signals that consumers and their agents send via browser controls or other universal mechanisms -- meaning companies wouldn't be able to require consumers to opt out on a site-by-site basis. (Companies could still ask consumers who activate a global opt-out to make exceptions on a site-by-site basis.)

The proposed law also prohibits companies from obtaining consent via “dark patterns” -- defined as user interfaces designed to subvert users' choices.

If signed into law, the bill will take effect in July of 2023.

Advocacy group Consumer Reports cheered news of the bill's passage, but suggested the measure should be revised to prevent companies from charging higher fees to consumers who opt out.

“We commend Colorado legislators for including provisions in the Colorado Privacy Act that will make it easier for residents to take control of their personal information,” Maureen Mahoney, senior policy analyst at Consumer Reports, stated Tuesday afternoon. “If the governor approves the bill, we urge the legislature to strengthen it in the future, including by clarifying that consumers can’t be charged for exercising their privacy rights.”

The ad industry opposes the bill for several reasons, including its provisions regarding global opt-out mechanisms.

The Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative and American Advertising Federation said last week in a letter to lawmakers that any requirement to honor universal opt-out mechanisms should also include “safeguards” aimed at ensuring consumers -- not browser developers or other intermediaries -- have activated those mechanisms.

The organizations also argued that the proposed law's definition of “sensitive” data is too broad. They suggested narrowing the definition so that data concerning race, ethnicity, religious beliefs, health, sexual orientation and citizenship should only be considered sensitive if it is "used to make decisions that produce legal or similarly significant effects concerning a consumer."