COLORADO PRIVACY ACT: WHAT IT DOES

Senate Bill 190 would be known as the Colorado Privacy Act, and housed within the Colorado Consumer Protection Act.

Under the bill, any online entity that controls or processes personal data of 100,000 or more consumers per year would have to provide an “opt out” to consumers on whether the company can sell or share any personal data collected.

SB 190 also goes after what’s known as “dark patterns.” A dark pattern is a kind of trick that websites use to hide information from consumers, such as how to delete an account or where to find the place to opt out on data collection. The bill states that websites that use “dark patterns” have not obtained consent from consumers if the consumer cannot find the way to opt out.

It also requires consent for collection of “pseudonymous data,” which is personal data that cannot be attributed to a specific person without additional information that is kept separately. For example, when you go to an event and use an online ticket to check in, the barcode has a number that can be traced back to the purchaser. It’s commonly used in marketing, according to the Data and Marketing Association.

The bill provides exemptions for health data, given that personal health information is largely protected by the federal Health Insurance Portability and Accountability Act of 1996.