Colorado universal opt-out mechanisms: GPC and website checks

The United States does not have one general federal privacy law equivalent to GDPR. Coverage, definitions and required interfaces differ by state, so build a rules engine around jurisdiction and processing purpose rather than cloning one banner everywhere.

The Colorado Privacy Act has applied since 1 July 2023 and includes rights to opt out of targeted advertising, sale and certain profiling.

Colorado requires covered controllers to honour recognised universal opt-out mechanisms. The Colorado Attorney General identifies GPC as a valid mechanism.

Treat the signal as an input to the central preference service. Enforcement must reach tags, audiences, API events and downstream vendors.

A covered retailer uses customer activity for targeted advertising. For a Colorado visitor who sends GPC, the retailer must honor the applicable opt-out for targeted advertising and sale. The signal is not a blanket request to disable every essential website function.

Compare a fresh visit with GPC enabled against one without it. Check the central preference state, browser requests and any backend advertising forwarding. Reload and sign in to confirm later events do not silently undo the opt-out. Keep the region, signal, expected outcome and observed destinations in the test record.

Sensitive-data processing can require consent. This is not interchangeable with an advertising opt-out: model them as different legal actions with separate purposes, records and revocation behaviour.

Maintain a processing inventory, jurisdiction matrix and versioned rules. The interface should explain the rights available in the visitor’s region while preserving a consistent preference centre.