§ 6-1-1313 — Rules - opt-out mechanism

(1) The attorney general may
promulgate rules for the purpose of carrying out this part 13.

(2) By July 1, 2023, the attorney general shall adopt rules that detail the
technical specifications for one or more universal opt-out mechanisms that clearly
communicate a consumer's affirmative, freely given, and unambiguous choice to
opt out of the processing of personal data for purposes of targeted advertising or
the sale of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or (1)(a)(I)(B). The
attorney general may update the rules that detail the technical specifications for
the mechanisms from time to time to reflect the means by which consumers
interact with controllers. The rules must:

(a) Not permit the manufacturer of a platform, browser, device, or any other
product offering a universal opt-out mechanism to unfairly disadvantage another
controller;

(b) Require controllers to inform consumers about the opt-out choices
available under section 6-1-1306 (1)(a)(I);

(c) Not adopt a mechanism that is a default setting, but rather clearly
represents the consumer's affirmative, freely given, and unambiguous choice to opt
out of the processing of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or
(1)(a)(I)(B);

(d) Adopt a mechanism that is consumer-friendly, clearly described, and
easy to use by the average consumer;

(e) Adopt a mechanism that is as consistent as possible with any other
similar mechanism required by law or regulation in the United States; and

(f) Permit the controller to accurately authenticate the consumer as a
resident of this state and determine that the mechanism represents a legitimate
request to opt out of the processing of personal data for purposes of targeted
advertising or the sale of personal data pursuant to section 6-1-1306 (1)(a)(I)(A) or
(1)(a)(I)(B).

(3) By January 1, 2025, the attorney general may adopt rules that govern the
process of issuing opinion letters and interpretive guidance to develop an
operational framework for business that includes a good faith reliance defense of
an action that may otherwise constitute a violation of this part 13. The rules must
become effective by July 1, 2025.

Legislative History

Source: L. 2021: Entire part added, (SB 21-190), ch. 483 p. 3464, � 1, effective July 1, 2023.