The Colorado Privacy Act, enacted in 2021, comes into effect on 1^st July 2023. The act creates personal data privacy rights, including the right to opt out of the processing of personal data, and places obligations on data controllers.

Colorado is the third US state to introduce its own privacy law, following California and Virginia.

Under the Act, data controllers must allow consumers to opt out of targeted advertising or the sale of personal data through an opt-out mechanism.

The Insights Association has filed comments with the state attorney general to seek clarification that an exception from the definition of ‘targeted advertising’ in the Act covers both internal first-party audience measurement and independent audience measurement, for all kinds of content, not just advertising.

It said: “Audience measurement, particularly independent audience measurement, builds the currency upon which advertising and other content, online and off, is valued, and collects covered data about individuals for the purpose of understanding groups.” 

The organisation also asked the attorney general to determine which opt-out mechanism will be recognised for the Colorado Privacy Act, noting “the cost of implementing such mechanisms.”

Additionally, the Insights Association has urged the attorney general to draft rules so that separate privacy policies and state-specific sections are not required within a given privacy policy. It noted: “[a] proliferation of state state-specific notices and disclosures will confuse consumers and not meaningfully further consumer privacy.”

The body also sought clarity on the issue of participants providing sensitive data, for example, demographic information such as race or ethnicity, as part of a market research study.