What’s Working: Colorado’s deadline for websites to add “Do not sell my data” detector is Monday 

Tamara Chuang

Business/Technology Reporter

Quick links: How to opt-out for consumers | How to comply tips for Business | Not just Colorado | Retirement poll results | DenAI is coming

Websites that interact with Colorado residents have been required to give visitors a choice that often looks like this:

“Do not sell or share my personal information”

or

“OK” (which could mean, yes, sell it and tell the world!)

But consumers may start seeing fewer of these messages starting Monday because of a law that kicks in to make a user’s default privacy settings well known to websites. There’s action needed by consumers, as well as by companies to get their websites in compliance.

The message stems from the Colorado Privacy Act, which passed in 2021, and has been in effect for the past year. The law gives Colorado consumers more control of their personal data that companies may have collected or are still collecting. This includes the right to:

• Know if personal data is being collected
• See what data was collected
• Ask that it be deleted or corrected, or downloaded and removed to transfer it to another site
• Opt out of its sale or its use for targeted advertising and profiling 

The law is already a year old but one last part comes due July 1, 2024.

By Monday, websites that attract Colorado visitors must be able to detect a visitor’s privacy preferences using a tool created by Global Privacy Control, which the Colorado Attorney General’s Office approved after a public comment period. GPC is a consortium of universities, tech firms, consumer advocates and media companies, including The New York Times. More tools could be approved but for now, this is the only one.

The point behind this so-called Universal Opt-Out Mechanism, or UOOM, is that it’s annoying for consumers to have to configure privacy settings for every site. They only need to do it once, thanks to the GPC standard.

“When your browser is configured to set GPC, every single website you go to includes the instruction, ‘Don’t sell my data’ or ‘Don’t share my data.’ It’s like a little flag that the website has to go look for” and respond, said Justin Brookman, director of technology policy at Consumer Reports as well as editor of the GPC spec. “It’s like wearing a T-shirt that says, ‘Don’t hug me,’ and walking around the public so everyone can see it and make choices about whether to hug you or not.”

What consumers need to do

For this to work, consumers must use a tool that talks to GPC. Those are plentiful and free.

Internet browsers like Firefox, DuckDuckGo and Brave have the no-sharing-data options built in, with the latter two turned on by default. For Firefox, you’ll need to add a checkmark next to the the privacy preference, as seen in the image below (find it by pressing the menu button in the browser’s upper right, then Settings and then Privacy & Security):

Chrome users can add a browser extension, like the Electronic Frontier Foundation’s Privacy Badger or OptMeowt, from the Wesleyan University math department’s Privacy-Tech-Lab.

Several options are also mentioned on GPC’s site — at globalprivacycontrol.org/orgs — that would help businesses honor GPC and maintain consumer privacy options.

Some of the privacy tools go a step further by configuring which cookies or ads to allow or block per site.

Here’s an example of what my Privacy Badger within the Chrome browser looks like on the Colorado AG’s page about the opt-out options. There are four potential trackers, plus three other cookies that don’t appear to be tracking users.

When a consumer rejects all cookies, some sites do warn that this could break the website’s experience and log users out of accounts so they have to always log back in.

But rejecting all doesn’t always mean all cookies are rejected. It’s more like “reject most,” said Brookman, who almost always hits the “reject all” option.