Ensuring compliance is no longer a choice but a necessity in today's highly regulated and interconnected data-driven digital ecosystem, where non-compliance can lead to severe legal, financial, and reputational consequences.
The Colorado Privacy Act (CPA) is no exception. Gaining a sound understanding of CPA and its requirements, especially its stance on re-obtaining consumer consent, is crucial for organizations to whom the CPA applies and organizations looking to engage in targeted advertising or the sale of personal data while honoring consumers’ privacy rights.
The Colorado Privacy Act (CPA) - A Quick Overview
The Colorado Privacy Act (CPA) is a comprehensive state data privacy law in Colorado. The CPA was signed into law on July 7, 2021, and came into effect on July 01, 2023. Although the CPA is modeled similarly to the Virginia Consumer Data Protection Act (VCDPA) and Washington Privacy Act, it also closely resembles the California Consumer Privacy Act (CCPA) and the European Union’s General Data Protection Regulation (GDPR).
The CPA provides significant protections for the personal data of Colorado residents, establishing new standards for the collection, use, and sharing of personal data by collectors that conduct business, deliver, or produce commercial services or products in the state. It empowers data subjects with various rights, including the right to confirm, access, rectify, delete, data portability, and opt-out of processing personal data for purposes of targeted advertising, the sale of personal data, or profiling.
Consumer Consent Under Colorado Privacy Act (CPA)
The CPA requires the organizations to obtain opt-in consumer consent for processing sensitive personal data, selling or processing personal data for the purposes of targeted advertising or profiling after the consumer has opted out, and processing personal data for secondary purposes. Further, the processing of personal data concerning a known child must be undertaken after obtaining valid consent from the child's parent or lawful guardian.
Re-obtaining Consent - A Delicate Balancing Act
The challenge arises when an organization wants to re-obtain consent from a consumer who has already opted out of the processing for targeted advertising or the sale of personal data. In such a scenario, the CPA has a transparent standpoint – to prevent consent fatigue or violating consumer’s privacy, re-obtaining consent must be done with careful consideration.
The CPA explicitly requires that consent meets many of the same requirements as the GDPR, including being specific, informed, unambiguous, freely given, and obtained through clear, affirmative action. Consent is not valid if it constitutes practices such as using dark patterns (using design to manipulate consumer choices), blanket acceptance of terms of service, silence, inactivity or inaction, pre-ticked boxes, and similar manipulative practices.
Requirements for Re-obtaining Consent Under Colorado Privacy Act (CPA)
The CPA requires that if a controller wishes to re-obtain consent for a processing purpose for targeted advertisement or the sale of personal data from the data subject who has opted out in the past, the following important requirements must be met:
Clear and Conspicuous Notice
Before re-obtaining consent for the processing of personal data for targeted advertising or the sale of personal data, the controller must provide a clear and conspicuous notice to the consumer. This notice must outline the choices available to the consumer under the law, the categories of personal data to be processed, and the purpose for which the data will be processed. Additionally, it must include an explanation of when and how consumers may withdraw their consent.
Consent Mechanism
The web page, application, or other means used for obtaining consent must also include a simple and easily accessible process for revoking consent. The mechanism for revocation must be as simple and easy as the process for providing consent.
The controller is restricted from requesting consent through methods that lead to consent fatigue, such as interface-dominating cookie banners on the controller's website or application, high-frequency requests, pop-ups, cookie walls, or any other type of interstitial that impedes or degrades the user experience.
Access to Privacy Setting Page
The controller may proactively request consent by providing a link to a privacy settings page, menu, similar interface, or comparable offline method that enables the consumer to re-consent to the opt-out purpose. This is permitted if the consent complies with the other requirements under the CPA, such as the mandatory disclosures and the mechanism being prominent, concise, separate, and distinct from other terms and conditions.
How Organizations Can Build Mechanisms to Re-Obtain Consent
Following the CPA's standards, here’s how organizations can establish this careful balance and still obtain customer consent:
Transparency
It's essential to maintain complete transparency with consumers. Inform them of the changes in data processing practices and clearly state the benefits they can expect from re-consenting to the targeted advertisement or sale of personal data.
Granular Choices
The CPA encourages organizations to provide granular consent options, enabling consumers to opt for specific types of data processing as per their choice. This also ensures that organizations honor consumer privacy rights and reduce the risk of consent fatigue.
User-Friendly Interfaces
Organizations must avoid using annoying pop-up banners or cookie consent forms that force people to agree to the use of cookies. Instead, user-friendly interfaces that facilitate seamless, conscious, and informed decision-making by consumers must be employed. Any methods/interfaces for obtaining consent that rely on dark patterns must be completely eliminated.
Educational Resources
Organizations must provide consumers with guidance, such as user manuals or frequently asked questions, to help them understand the consequences of their decisions and the significance of consent.
Opt-Out Accessibility
Provide customers with an easy way to alter their consent preferences at any moment and empower them to maintain control over their data.
How Securiti Can Help
Securiti’s Consent Management Platform (CMP) simplifies the management of first-party and third-party consent, enabling organizations to meet the foregoing requirements of the CPA to re-obtain consent from consumers who have opted out of the processing of their personal data. The platform offers a consent ‘preference center’ that an end-user can visit at any time to change their consent settings for each processing purpose.
Therefore, by visiting the preference center, a consumer may choose to opt back into the same processing purpose at any moment if they have opted out of having their personal data processed for purposes such as targeted advertising, the sale of their personal data, or profiling. This mechanism to re-obtain consent from consumers is an effective solution for fulfilling consent requirements under the CPA:
- Securiti offers a preference center that an end-user (consumer) can visit at any time to change their consent settings, including opting back into a processing purpose after previously opting out.
- Securiti enables organizations to publish a link to the preference center on their websites. Thus, they would not rely on any method to re-obtain consent that causes consent fatigue or adversely impacts the consumers’ web experience, such as pop-ups, cookie walls, or interface-dominating cookie banners.
- Securiti enables organizations to directly email the link to the preference center to their consumers if they reasonably believe that a consumer intends to opt back into the sale of their personal data or processing for targeted advertising.
Request a demo to witness Securiti in action.
