Colo. AG Weiser Outlines Privacy Law Rulemaking Due in Fall

Before drafting rules for Colorado’s privacy law, the attorney general’s office will seek comments “over the next few months,” said AG Phil Weiser (D) in prepared remarks Friday. “During this time, we will post a series of topics for informal input on our website and solicit responses in writing and at scheduled events.” The office will post an NPRM by fall with proposed rules and seek more comments, Weiser said. “We expect to be in a position to adopt final rules around a year from now.” Colorado’s law “makes plain that consumers deserve the right to access and control the use of their data,” Weiser said. “Consumers have a right to know what information companies collect about them and how that information will be used, enabling them to reject the sale and use of their private data by third parties.” The process must “be conducted fairly, free from what some have called ‘dark patterns,’ which can unfairly mislead consumers on this issue,” the AG said. “We will need to consider what the process will be for consumers to engage and learn about their data profiles as well as to correct inaccurate data,” and the office might provide guidance on company auditing and data protection assessment procedures, he said. The Colorado law takes effect July 1, 2023.