Navigating Consent in Compliance : Understanding the Colorado Privacy Act’s Stance on Re-obtaining Consumer Consent

Consumer Consent Under Colorado Privacy Act (CPA)

The CPA requires the organizations to obtain opt-in consumer consent for processing sensitive personal data, selling or processing personal data for the purposes of targeted advertising or profiling after the consumer has opted out, and processing personal data for secondary purposes. Further, the processing of personal data concerning a known child must be undertaken after obtaining valid consent from the child's parent or lawful guardian.

Re-obtaining Consent - A Delicate Balancing Act

The challenge arises when an organization wants to re-obtain consent from a consumer who has already opted out of the processing for targeted advertising or the sale of personal data. In such a scenario, the CPA has a transparent standpoint – to prevent consent fatigue or violating consumer’s privacy, re-obtaining consent must be done with careful consideration.

The CPA explicitly requires that consent meets many of the same requirements as the GDPR, including being specific, informed, unambiguous, freely given, and obtained through clear, affirmative action. Consent is not valid if it constitutes practices such as using dark patterns (using design to manipulate consumer choices), blanket acceptance of terms of service, silence, inactivity or inaction, pre-ticked boxes, and similar manipulative practices.

Requirements for Re-obtaining Consent Under Colorado Privacy Act (CPA)

The CPA requires that if a controller wishes to re-obtain consent for a processing purpose for targeted advertisement or the sale of personal data from the data subject who has opted out in the past, the following important requirements must be met:

Clear and Conspicuous Notice

Before re-obtaining consent for the processing of personal data for targeted advertising or the sale of personal data, the controller must provide a clear and conspicuous notice to the consumer. This notice must outline the choices available to the consumer under the law, the categories of personal data to be processed, and the purpose for which the data will be processed. Additionally, it must include an explanation of when and how consumers may withdraw their consent.

Consent Mechanism

The web page, application, or other means used for obtaining consent must also include a simple and easily accessible process for revoking consent. The mechanism for revocation must be as simple and easy as the process for providing consent.

The controller is restricted from requesting consent through methods that lead to consent fatigue, such as interface-dominating cookie banners on the controller's website or application, high-frequency requests, pop-ups, cookie walls, or any other type of interstitial that impedes or degrades the user experience.

Access to Privacy Setting Page

The controller may proactively request consent by providing a link to a privacy settings page, menu, similar interface, or comparable offline method that enables the consumer to re-consent to the opt-out purpose. This is permitted if the consent complies with the other requirements under the CPA, such as the mandatory disclosures and the mechanism being prominent, concise, separate, and distinct from other terms and conditions.

How Organizations Can Build Mechanisms to Re-Obtain Consent

Following the CPA's standards, here’s how organizations can establish this careful balance and still obtain customer consent:

Transparency

It's essential to maintain complete transparency with consumers. Inform them of the changes in data processing practices and clearly state the benefits they can expect from re-consenting to the targeted advertisement or sale of personal data.

Granular Choices

The CPA encourages organizations to provide granular consent options, enabling consumers to opt for specific types of data processing as per their choice. This also ensures that organizations honor consumer privacy rights and reduce the risk of consent fatigue.

User-Friendly Interfaces

Organizations must avoid using annoying pop-up banners or cookie consent forms that force people to agree to the use of cookies. Instead, user-friendly interfaces that facilitate seamless, conscious, and informed decision-making by consumers must be employed. Any methods/interfaces for obtaining consent that rely on dark patterns must be completely eliminated.

Educational Resources

Organizations must provide consumers with guidance, such as user manuals or frequently asked questions, to help them understand the consequences of their decisions and the significance of consent.

Opt-Out Accessibility

Provide customers with an easy way to alter their consent preferences at any moment and empower them to maintain control over their data.

How Securiti Can Help

Securiti’s Consent Management Platform (CMP) simplifies the management of first-party and third-party consent, enabling organizations to meet the foregoing requirements of the CPA to re-obtain consent from consumers who have opted out of the processing of their personal data. The platform offers a consent ‘preference center’ that an end-user can visit at any time to change their consent settings for each processing purpose.

Therefore, by visiting the preference center, a consumer may choose to opt back into the same processing purpose at any moment if they have opted out of having their personal data processed for purposes such as targeted advertising, the sale of their personal data, or profiling. This mechanism to re-obtain consent from consumers is an effective solution for fulfilling consent requirements under the CPA:

• Securiti offers a preference center that an end-user (consumer) can visit at any time to change their consent settings, including opting back into a processing purpose after previously opting out.
• Securiti enables organizations to publish a link to the preference center on their websites. Thus, they would not rely on any method to re-obtain consent that causes consent fatigue or adversely impacts the consumers’ web experience, such as pop-ups, cookie walls, or interface-dominating cookie banners.
• Securiti enables organizations to directly email the link to the preference center to their consumers if they reasonably believe that a consumer intends to opt back into the sale of their personal data or processing for targeted advertising.

Request a demo to witness Securiti in action.