Colorado: Why Choice Provenance Matters
Colorado’s Universal Opt-Out Mechanism rules ask a question that cannot be answered by inspecting a signal after it arrives: did the consumer actually choose to use the mechanism? This chapter focuses on that choice provenance, as well as the purposes a Colorado mechanism may carry and the responsibilities that follow for its provider and the receiving controller. The result is a practical way to distinguish a valid UOOM from a default setting that merely happens to send similar data.
The Colorado rules are closely related to California’s signal model but are not interchangeable with it. Colorado expressly names targeted advertising and the sale of personal data as opt-out purposes, and permits a mechanism to communicate either purpose or both. It also gives affirmative, freely given, and unambiguous choice a central role. A message can be technically legible yet legally incomplete if the circumstances that produced it do not show a consumer’s meaningful choice.
A Colorado UOOM carries a purpose, not every right
Colorado defines a Universal Opt-Out Mechanism as a mechanism that clearly communicates a consumer’s affirmative, freely given, and unambiguous choice to opt out of processing personal data for targeted advertising, the sale of personal data, or both. The rules describe the practical benefit in simple terms: a consumer can exercise the selected opt-out rights with all controllers they interact with without making an individualized request to each one.
That convenience does not make the mechanism a general-purpose instruction. A UOOM may communicate a choice about targeted advertising alone, sale of personal data alone, or both. A controller is not required to honor unrelated rights transmitted through the mechanism. A reader should therefore ask “which purpose?” before asking “did the signal arrive?” The answer determines what processing the controller must stop or restrict.
This purpose-specific design differs from a vague browser setting that claims to protect privacy in the abstract. A consumer can reasonably use one tool for several purposes, but the legal effect still depends on what the mechanism clearly tells the consumer it will do. The Colorado rules require the platform, developer, or provider to make that purpose clear in the configuration or public disclosures. The notice may explain that the mechanism exercises opt-out rights under state laws without naming Colorado, as long as its meaning and limitations are clear and the other requirements are met.
The limitation matters when a consumer visits a controller that sells personal data but does not use targeted advertising, or one that uses targeted advertising but does not sell personal data. The mechanism must communicate the choice that applies. If it carries both purposes, the controller must treat both as selected. If it carries only one, the controller cannot silently expand the request to an unrelated purpose, and the consumer cannot assume that the unselected purpose was covered merely because both are often discussed together.
Colorado also requires a valid UOOM to represent an affirmative, freely given, and unambiguous choice. Those words are not decorative. “Affirmative” means the consumer’s action must establish the choice rather than leave it to silence or a preselected option. “Freely given” means the choice cannot be extracted through a structure that makes the opt-out effectively unavoidable. “Unambiguous” means the consumer should be able to understand what the mechanism will communicate and for which purpose.
The rule therefore connects the content of the signal to the conditions under which the consumer activated it. The receiving controller sees a technical message, but the legal system also cares about the event that gave the message its meaning. This is why Colorado’s mechanism cannot be evaluated as a syntax-only interface.
Purpose selection also changes how a controller should reason about mixed business practices. Imagine a controller that shares personal data for targeted advertising but does not sell personal data in the sense covered by the Colorado rule. A UOOM carrying only the targeted-advertising choice reaches the practice the consumer selected; it does not need to be stretched into a sale opt-out. In the opposite case, a controller that sells personal data but does not use it for targeted advertising must read the selected purpose in the other direction. If the mechanism communicates both choices, both obligations attach as indicated. The signal’s breadth is determined by the consumer’s communicated selection, not by the controller’s preference for a single convenient category.
This is also why a UOOM cannot be treated as a general replacement for every request channel. A consumer may later want access to personal data, correction of an inaccurate record, deletion, or another right. Those requests concern different questions: what information the controller holds, whether it is accurate, whether it must be removed, or whether another processing activity is permitted. The UOOM rules do not say that the mechanism silently carries those requests. A controller that receives a UOOM must honor the purposes the mechanism communicates, while preserving separate procedures for rights the mechanism does not represent.
The distinction protects both sides of the interface. Consumers can use a single tool to communicate a selected opt-out across controllers without having to understand each controller’s internal vocabulary. Controllers, in turn, can interpret the signal without guessing that every privacy concern has been bundled into it. The legal design is broad enough to reduce repeated requests but specific enough to keep the requested purpose visible. A mechanism that obscures the purpose may be technically convenient while leaving the controller unable to determine which state change the consumer actually chose.
The legal system also validates how the choice was made
The clearest Colorado distinction concerns defaults. A UOOM may not be the default setting of a tool that comes pre-installed with a device, such as a browser or operating system. If the browser sends the signal automatically and never asks the consumer to enable it, the consumer’s decision to use the pre-installed browser does not count as an affirmative, freely given, and unambiguous choice to use the mechanism. The fact that the tool is marketed as privacy-protective does not cure the absence of an actual choice in the example supplied by the rule.
A different first-run design can produce a different result. If the operating system asks clearly whether the consumer wants to opt out, presents no preselected answer, and the consumer chooses to enable the signal, the rules treat that action as the required affirmative choice. The important detail is not simply that a prompt appeared. The prompt must force a real decision without quietly making one answer the default.
Colorado makes a further distinction for tools that do not come pre-installed. If a consumer installs a browser or operating system marketed as a tool that exercises opt-out rights, the decision to install it can itself represent the affirmative choice. The mechanism may then send the signal by default after installation. In that situation, the consumer’s voluntary adoption of a tool with the advertised function supplies the provenance that was missing from the pre-installed-default example.
These examples do not establish a universal rule that every browser default is invalid or that every installation is sufficient. They establish a factual inquiry. Was the tool already placed on the device? Did the consumer have to adopt it? What did the marketing or configuration communicate? Was the opt-out purpose clear? Did the interface ask for a genuine choice, or did it simply act without the consumer deciding? The same wire-level value can matter differently depending on those facts.
Choice provenance is only one side of the system. Colorado also limits what the mechanism provider and the controller may do with information connected to the choice. A platform, developer, or provider may not use, disclose, or retain personal data collected through the UOOM for another purpose. The rules give digital fingerprinting as a concrete warning: the fact that a device sends a UOOM may not be reused to identify that device later for unrelated purposes.
The controller faces a related data-minimization rule. While processing a UOOM, the controller may not require additional personal data beyond what is strictly necessary to authenticate Colorado residency, determine that the mechanism represents a legitimate request, or satisfy a specific authentication requirement imposed by another jurisdiction’s universal-opt-out law. The controller may offer an option to provide more information when that would extend recognition across platforms, devices, or offline sale of personal data. A phone number or email address can serve that optional purpose, but the information remains limited to processing the opt-out.
This produces an important asymmetry. The controller may need to decide whether the request is legitimate and whether Colorado law applies, but it may not turn routine recognition into a broad identity-collection exercise. An optional identifier can broaden the request across devices; it does not become permission to use the identifier for advertising, profiling, or unrelated account enrichment. Reasonable security measures also apply to personal data processed in connection with the mechanism.
The rules place some responsibility on the mechanism itself. A UOOM must allow consumers to communicate their choice automatically with multiple controllers. It may send an opt-out signal in a commonly used format, such as an HTTP header field or JavaScript object. It must allow clear communication of one or more opt-out rights, use reasonable security, and not prevent the controller from determining whether the consumer is a Colorado resident or whether the request is legitimate. It also may not unfairly disadvantage controllers through self-dealing that benefits the mechanism’s creator.
Colorado addresses the remaining interoperability problem through a public recognition list. The Department of Law is to maintain a list of UOOMs recognized as meeting the rule’s standards. Recognition requires compliance with the technical and other specifications and avoiding confusion about similarities and differences among listed mechanisms. The Department may also consider commercial adoption, ease and cost of implementation and detection, approval by a legitimate standards body, and whether the system is open or available on fair terms.
The list is not a claim that one named commercial product is valid; the supplied rules do not identify the current contents of the list. Its function is institutional. A controller needs enough technical detail to identify a mechanism when a consumer uses it, and the rules give controllers six months to recognize a mechanism after it is added. That notice period turns an uncertain discovery problem into a scheduled interoperability obligation. Controllers may also recognize mechanisms that are not on the public list, so the list is a floor for organized recognition rather than an exclusive authorization catalog.
Once the relevant delayed date arrives, Colorado’s controller obligation becomes persistent. The supplied rules state that, effective July 1, 2024, a controller receiving an opt-out request through a UOOM must treat it as a valid request for the selected purpose or purposes for the associated browser or device and, if known, the consumer. The controller must continue treating that browser, device, and consumer as having opted out until the consumer gives compliant consent. A controller may display a conspicuous message that the signal was honored, but the display is evidence of processing, not the source of legal effect.
The controller also may not require a consumer to log in or undertake unnecessarily burdensome authentication merely as a condition of recognizing a UOOM, unless the governing statute permits authentication. The rules distinguish the ability to authenticate from an obligation to demand it. That distinction preserves the mechanism’s low-friction purpose while leaving room for the legal conditions that may genuinely matter, such as determining residency or legitimacy.
Colorado’s model therefore adds a missing dimension to the idea of a legal signal. California’s rules show how a communicated meaning and an observable scope can create a sale/sharing request. Colorado shows that the law may also inspect the consumer’s path to the signal: a silent pre-installed default is not equivalent to a voluntary adoption or an unpreselected first-run choice. The mechanism’s provider must protect the choice data from repurposing, the controller must recognize the mechanism without excessive identity demands, and the resulting opt-out must persist until the consumer affirmatively consents. The next question is what happens inside that persistent state—how a business or controller applies it, propagates it, displays it, and handles a later attempt to reverse it.