Tamara Chuang | Business/Technology Reporter
Quick links: Colorado’s C+ grade | Neural data privacy | More privacy bills | Starbucks union wins again
Colorado has the second strongest law in the land that protects consumer privacy and data, according to a new report card from a consumer public interest group. But the state also scored a mere C+ for its efforts.
Though it has initiated consumer-friendly rules — such as one that will let Coloradans press a button to opt out of having their personal data collected and sold online starting in July — the state’s protections could be much stronger, said R.J. Cross, director of the Don’t Sell My Data campaign for the U.S. Public Interest Research Group, a progressive advocacy group based in Denver. Most of the 14 states with privacy laws on the books received a D or F rating. As for the other 36 states with no laws? She calls them “incomplete.”
“We have high standards because the stakes are really high,” Cross said. “Right now, there is a secret economy that is gathering data about us and selling it and sharing it to a bunch of companies we’ve never heard of and doing all sorts of stuff with it. And the more companies that hold data about us and the more companies are selling it, the more likely our information is going to be exposed in a breach or hack and end up with identity thieves, fraud and damage to your credit score. There’s a lot of things that can happen.”
The Colorado Consumer Privacy Act, passed in 2021, attempts to return control of a person’s personal data to the individual. The first set of rules went into effect in July. Last month, the Colorado Attorney General approved the first tool to give consumers a single universal opt-out button. Global Privacy Control, a technical standard developed by a coalition of privacy-minded tech companies and organizations, has instructions on how to integrate the tech into a website. It’ll send a signal to stop collecting unnecessary data. The AG could approve more such tools before July 1.
Companies that control the data from 100,000 Colorado residents or more must disclose their data collection practices and allow customers to ask what personal data is being collected. Businesses must also let customers correct or delete their data, allow them to download it and opt out of it being sold or shared with third parties that use it for targeted advertising.
Why Colorado got a C+
But Cross said Colorado doesn’t let consumers take a company to court for violating their privacy rights nor does it restrict controversial data use by making its “data minimization” language clearer. “Colorado’s includes data minimization language but it’s very industry friendly and essentially says that a company can gather most types of data and do pretty much whatever they want as long as they disclose it in a privacy policy,” she said. “That’s not really being transparent with people about what’s happening with their data.”
Business groups like the Colorado Chamber of Commerce opposed efforts to roll out a universal opt-out tool calling it “premature” and saying it doesn’t allow companies to “sufficiently (and) accurately confirm the identity and residency of the consumer,” according to a Dec. 10 letter to the AG’s office. Such applications also don’t “ensure consumers make an informed choice” and customers may wind up with permanently deleted accounts.
According to the AG’s office, companies found to be in violation will be sent a letter to fix the issue within 60 days. But Colorado Attorney General Phil Weiser said he plans to work with businesses to make compliance easier.
“And for those businesses who make honest mistakes, we will work to enable them to comply with the law,” he said. “(While) for those willfully violating the law, we will work to enforce it vigorously.”
Weiser called PIRG’s C+ grade the result of “a demanding curve,” he said. “I view this as they’re giving us feedback that we have room to improve and I’m always open to suggestions on how we can improve when you grade us against other states. They’re saying we’re No. 2. And I say, we try harder.”
➔ Read the Colorado report, U.S. report
➔ 50 million users already use Global Privacy Control. Consumers can install browser extensions like the Electronic Frontier Foundation’s Privacy Badger, Abine’s DeleteMe and others, or switch to private browsers from DuckDuckGo or Firefox, which are all part of the GPC coalition. The tools help users see what sites track personal data and then block or allow the trackers.
We’ll look further into consumer privacy in Colorado and how the law protects residents and applies to businesses in future stories. If you have concerns and comments, please share them by emailing tamara@coloradosun.com
But wait, there’s more: Protecting your neural data
At an event last spring, Rep. Cathy Kipp, a Fort Collins Democrat, met neurologist Sean Pauzauskie in her district. Pauzauskie had concerns about what’s happening with products that scan brain waves and translate them into something humans can understand.
“Things like an Australian cap that they’ve just come with, a skullcap, which if you wear it, has a 40% accuracy rate on the thought-to-text translation,” Kipp said. “The technology for mind reading, frankly, and reading your thoughts is coming along very rapidly. And the place the technology is going next is to influence your thoughts and behavior.”
In other words, she added, if it helps you quit smoking, that’s great. But if the company collects customer brain waves and tries to mine or sell them, then what? There are about 30 products out right now and many are already reselling customer data, she said. “You don’t want people poking around your mind otherwise,” she said.
House Bill 1058, also called Protect Privacy of Biological Data, passed the House 61-1 Friday and moves on to the Senate. Kipp, the prime sponsor of the bipartisan-backed bill along with Rep. Matt Soper, R-Delta, said she wants Colorado to set limits as to how a person’s neural and biological data, such as genetic information, can be shared and sold in the future. The bill seeks to amend the state’s Consumer Privacy Act to include neural and biological data as sensitive personal data to be protected.
If it passes, Colorado would be the first state to protect brain rights, according to Kipp. Chile passed a law in 2021.
Friday’s vote comes a few weeks after tech billionaire Elon Musk announced that his brain-implant company Neuralink implanted a chip in its first customer in hopes of helping quadriplegics and severely disabled people communicate with society.
“To be clear, the technology is doing some really, truly amazing things. It’s giving some mobility and communication to people with disabilities,” Kipp said. “But what we can read now is probably nothing like what we can read from your brainwaves in five years. We really feel people should have a right to privacy over their own thoughts.”
More legislative privacy bills:
➔ House Bill 110: Biometric identifiers and data privacy. A similar proposal seeks to limit how long companies can keep biometric data that identify people, like a fingerprint, voice print or retina scan. The bill, which also has bipartisan support, doesn’t mention neural data. This would also amend the current privacy law. >> Read more
➔ Senate Bill 41: Children’s online data. This would be another amendment to the Colorado Privacy Act and sponsored by Senate Minority Leader Paul Lundeen, a Monument Republican, and Senate Majority Leader Robert Rodriguez, a Denver Democrat. It enhances protections of children’s data, including prohibiting the collection of a minor’s precise geolocation and using a system to “increase, sustain or extend” a child’s use of a service or product. >> Read more
Sun economy stories you may have missed
➔ Must a gas utility pay its customers to unhook in the name of climate change? Atmos Energy, which provides only natural gas, is protesting environmental group demands that it help customers switch to clean electricity. Now, the state’s Public Utilities Commission will decide who pays. >> Read
➔ Cost to water crops could nearly quadruple in San Luis Valley. More than $100 million has been spent to retire wells and meet Rio Grande compact demands. But it’s not enough, as San Luis Valley farmers may now be asked to pay a lot more to continue pumping. >> Read
➔ AG settles with Marriott hotels on hidden fees. If you’re checking in for the night and the hotel clerk says you’ve got to pay an undisclosed nightly resort, amenity or other hotel fee, just say no, Attorney General Phil Weiser said. That’s illegal and violates the state’s Consumer Protection Act. Marriott is now showing that fee during the booking process. >> Read
➔ Discounted internet on track to end for 250,000 Colorado households in April. The federal Affordable Connectivity Program stopped accepting newcomers Feb. 7. Advocates hope Congress will extend funding. Are you an ACP customer who could lose the $30 discount for internet service? Email tamara@coloradosun.com and share your story. >> Read
Other working bits
➔ Starbucks must rehire Denver and Colorado Springs workers. Administrative Law Judge Mara-Louise Anzalone ruled Feb. 6 that coffee giant Starbucks violated the National Labor Relations Act when it fired two Colorado workers involved in union activities. Anzalone ordered Starbucks to reinstate Ryan Dinaro, who worked at the 16th Street Mall location at Tremont in Denver, and Joseph Mathis, an employee at the Academy store in Colorado Springs, and pay back wages and benefits. Starbucks must also cease and desist from disciplining workers because of their support for the Workers United unionizing efforts and post notices at the business locations about workers’ rights to form, join or assist a union. While about 10 Starbucks stores in Colorado have joined Starbucks Workers United, none has a contract with the company, according to local union officials. >> Read order
➔ Where is AI going? Before artificial intelligence takes over the world, tech and policy wonks debated whether to regulate AI this week at the University of Colorado’s Silicon Flatirons technology policy conference. One policymaker in attendance, Sen. John Hickenlooper, said the U.S. must require AI systems to be transparent on how they train and on what personal data they collect and conduct audits to verify systems are in compliance with any federal laws and regulations. >> Watch event videos
➔ Colorado marijuana sales fall to $1.5 billion in 2023. That’s lower than past years, according to the Colorado Department of Revenue, which tracks sales tax data. In 2021, marijuana sales hit an all-time high of $2.2 billion and dropped to $1.7 billion in 2022. Since February 2014, when the state legalized pot, there’s been $15.5 billion in sales and $2.6 billion collected in marijuana taxes and fees. >> The numbers
➔ Got a food-supply chain project? Colorado has $3 million in grants available. The funds are part of a $4.1 million award from the U.S. Department of Agriculture’s Resilient Food Systems Infrastructure Program. Colorado Department of Agriculture plans to use its share on a competitive grant funding for projects that “increase aggregation and storage options, particularly with cold and dry storage; processing facilities for individual quick freezing, freeze drying, drying, puree, and canning to create accessibility to institutional markets and expansion into consumer markets.” Applications are due March 7. >> Details
Get this in your inbox every Saturday for free. Subscribe!
Thanks for sticking with me for this week’s report. Remember to check out The Sun’s daily coverage online. As always, share your 2 cents on how the economy is keeping you down or helping you up at cosun.co/heyww. ~ tamara
Miss a column? Catch up:
What’s Working is a Colorado Sun column about surviving in today’s economy. Email tamara@coloradosun.com with stories, tips or questions. Read the archive, ask a question at cosun.co/heyww and don’t miss the next one by signing up at coloradosun.com/getww.
Support this free newsletter and become a Colorado Sun member: coloradosun.com/join