The Colorado Privacy Act explained for people who live off ads

Honor GPC

Since July 1, 2024, anyone above the thresholds must accept GPC as an opt-out of sale and targeted advertising. Today, it is the only signal recognized by the state.

Put the opt-out link outside the policy

The path to opt out is in a clear, easy-to-find place, outside the privacy policy. The link must lead straight to the opt-out and make clear what it is for.

Complete the privacy policy

The policy explains how visitors exercise their rights and how GPC opt-outs are processed, and shows the date of the last update.

Ask for active consent for sensitive data

Consent must be freely given, specific, informed and unambiguous. A pre-checked box does not count, and the person must be able to withdraw consent easily.

Do not require login or too much data

To accept GPC, the site cannot require login or ask for more data than strictly necessary.

Respond within 45 days

Requests get a response within 45 days, with one extension of another 45 if the visitor is notified. The first access request in 12 months is free.

Do the data protection assessment

Before selling data, processing sensitive data or doing other high-risk processing, the company documents an assessment. The attorney general can ask for this document.

Pass the opt-out to Google

In the Colorado section of the GPP string, an opt-out of sale or targeted advertising turns on RDP. You can also turn on RDP directly in the tag.

// GPT: liga o processamento restrito de dados (RDP)
// para quem recusou a venda ou a publicidade direcionada
googletag.cmd.push(function () {
  googletag.pubads().setPrivacySettings({
    restrictDataProcessing: true
  });
});