• by Wendy Davis  @wendyndavis, June 2, 2021

The ad industry is asking Colorado lawmakers to reject a proposed privacy law that would require companies to honor consumers' requests to opt out of targeted advertising -- including requests consumers make through browser settings or other global mechanisms.

“The bill is no more than a vehicle for big government overregulation that has the potential to impose crushing compliance costs on Colorado businesses -- particularly small businesses -- that support the state’s economy and its residents,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, Network Advertising Initiative and American Advertising Federation say in a letter to state lawmakers.

Colorado's proposed “Protect Personal Data Privacy” (SB 21-190) would require companies to allow state residents to access, correct, delete their non-sensitive personal data, and opt out of its processing -- including for the purpose of serving targeted ads. The measure defines personal data as information “linked or reasonably linkable” to identified or identifiable individuals.

The opt-out provisions specifically require companies to honor signals that consumers and their agents send via browser controls or other universal mechanisms -- meaning that companies can't require consumers to opt out of targeted ads on a site-by-site basis. (The measure provides that companies can ask consumers who use global opt-out mechanisms to make exceptions on a site-by-site basis.)

The bill would also require companies to obtain people's express consent before processing sensitive data -- including information that reveals race, ethnicity, religious beliefs, health conditions, citizenship status and sexual orientation.

Additionally, the proposed law prohibits companies from obtaining consumers' consent through the use of “dark patterns” -- defined as user interfaces designed to subvert users' choices.

The ad industry is criticizing the proposed law on several fronts. Among others, the ad groups say any requirement to honor universal opt-out mechanisms should also include “safeguards” aimed at ensuring consumers, not browser developers or other intermediaries, have activated those mechanisms.

“Legal requirements to honor global privacy controls through intermediary technologies, if not clearly stipulating they be genuinely enabled by users ... put consumer choice at risk and hinder consumers’ ability to express their actual preferences,” the ad groups write.

The organizations also say the proposed law's definition of “sensitive” data is too broad. They propose narrowing the definition so that data concerning race, ethnicity, religious beliefs, health, sexual orientation and citizenship should only be considered sensitive if it's “used to make decisions that produce legal or similarly significant effects concerning a consumer.”

The ad groups also say state lawmakers should take more time to rework the measure.

“The General Assembly should not pass the bill in the waning days of the 2021 legislative session and instead should work towards considering ways to improve the bill for next year,” they write.

The state's deadline to pass the bill is June 12.

Colorado is only one of several states to consider new privacy legislation this year.

Virginia passed a new privacy law, but bills failed in other states including Washington, Oklahoma and Florida.

New York lawmakers are still considering a bill that would require companies to obtain consumers explicit consent before drawing on their data for ad targeting.