How Publishers Can Prepare for the Colorado Privacy Act

U.S. Privacy Laws have certainly accelerated consumer protection measures over the last couple of years. Following Virginia with the VCDPA and California with the CPRA, Colorado has now become the third state to roll out a privacy law for its residents. 

How is CPA different than the recent U.S Privacy Law?  

The Colorado Privacy Act (CPA) is very similar to the VCDPA and CPRA. However, there are some differences that you need to be aware of if you have users located in these three states. The key distinction is around the fact that CPA requires a “user-selected universal opt-out mechanism” for the purposes of targeted advertising or the sale of personal data. 

Here’s a high-level summary for you: 

What do app developers need to do to become compliant with CPA? 

By July 1, 2023, app developers and publishers will need to:    

• Implement adequate data security safeguards
• Inform their consumers located in Colorado of their rights through a reasonably accessible and clear privacy policy which explains collection and use of data
• Update their contracts with third parties to ensure that they comply with the laws
• Acquire consent to process sensitive personal data, and acquire consent from parent or lawful guardian before obtaining children's personal data  
• Only share valid consented data with ad partners
• Provide a clear link to users to opt-out of processing of personal data for the purposes of targeted advertising, sale, or profiling
• Given the above, rely on a mechanism to honour consumer requests
• Establish a user-selected universal opt-out mechanism by July 1, 2024

How is InMobi preparing? 

We have made server-side changes to the do_not_sell flags from our publisher customers so they can inform us when a user opts out of targeted advertising, sale, or profiling. The same is applicable to our mediation partners and supported header bidding solutions. This means that publishers will be able to send us an opt-out flag at the request level.  

Publishers will be provided with all applicable DSRs (Data Subject Rights) i.e., Right to Delete, etc., through our updated DSR Management process. All publishers will soon be notified of this updated DSR Management process. 

For more information or support, please contact your Customer Success Manager or pmm-ssp@inmobi.com.