Current through Register Vol. 47, No. 17, September 10, 2024
A. To comply
with C.R.S. §
6-1-1313(2), a
Universal Opt-Out Mechanism may not be the default setting for a tool that
comes pre-installed with a device, such as a browser or operating system.
1. Example: An operating system manufacturer
bundles a browser pre-installed with every device shipped with the operating
system. The browser sends a Universal Opt-Out mechanism signal by default and
never asks the Consumer to enable this setting. The Consumer's decision to use
this browser does not represent the Consumer's affirmative, freely given, and
unambiguous choice to use the Universal Opt-Out Mechanism because it is a
default choice. This is so even if the marketing for the operating system touts
its privacy protective features.
2.
Example: An operating system manufacturer bundles a browser and apps
pre-installed with every device shipped with the operating system. The first
time a Consumer runs a browser or app, the operating system asks the Consumer
specifically and clearly whether they want to opt out of the Sale of their
Personal Data using a Universal Opt-Out Mechanism signal when using the browser
or app. No choice is pre-selected, meaning the Consumer is forced to decide.
The Consumer's decision to select "yes" to enable the signal to opt out of the
Sale of Personal Data represents the Consumer's affirmative, freely given, and
unambiguous choice to use the Universal Opt-Out Mechanism.
B. Notwithstanding
4 CCR 904-3, Rule
5.04 , a Consumer's decision
to adopt a tool that does not come pre-installed with a device, such as a
browser or operation system, but is marketed as a tool that will exercise a
user's rights to opt out of the Processing of Personal Data using a Universal
Opt-Out Mechanism, shall be considered the Consumer's affirmative, freely
given, and unambiguous choice to use a Universal Opt-Out Mechanism. The
marketing for such a tool may also describe functionality other than the
exercise of opt out rights and it need not refer specifically to opt-out rights
in the State of Colorado.
1. Example: A
browser manufacturer markets its browser as a "privacy friendly" browser,
prominently highlighting that the browser sends a Universal Opt-Out Mechanism
signal by default. The browser does not come pre-installed with a device or
operating system and must be installed by the Consumer. The Consumer's decision
to use this browser represents the Consumer's affirmative, freely given, and
unambiguous choice to use the Universal Opt-Out Mechanism. The Consumer need
not be given an explicit choice about whether to use the Universal Opt-Out
Mechanism in this example.
