Beginning July 1, 2024, organizations that fall within the Colorado Privacy Act (CPA) and Texas Data Protection Act, must allow individuals to opt-out of the sale of their personal data or use of their personal data for targeted advertising using a Universal Opt-Out Mechanism (UOOM). The Colorado Department of Law (the “Department”) accepted applications for UOOMs and recently published its shortlist of potential UOOMs for consideration. The shortlist includes three UOOMs: OptOutCode, the Global Privacy Control (“GPC”), and Opt-Out Machine. Kelsey Fayer and Gregory Szewczyk point out that “GPC essentially operates as a do not track signal for website browsing”, OptOutCode “applies across a multitude of Internet of Things scenarios”, while “Opt-Out Machine is email-based for more traditional data sales and data broker activities.” In order to make the final list, OptOutCode and Opt-Out Machine must demonstrate their ability to be as consistent as possible and not conflicting with GPC.  CPA, 6-1-1313(2)(e).

OptOutCode is consistent with GPC for two main reasons:

1. Complementary. GPC is a browser-level privacy signal designed to allow internet users to notify businesses of their preference to not have their data sold or shared, or used for cross-context behavioral advertising. Whereas, OptOutCode is compatible with smartphones, laptops, tablets, routers, apps, and IoTs. The average American spends 6 hours and 58 minutes online daily. Browsing social media accounts and streaming videos accounts for more than five hours of that time. Those online activities can be performed on browsers (where GPC acts as a protection for consumers), but also on apps, for which GPC has not been applied yet. In fact, it is common for companies with online properties to encourage and nudge consumers to stop consuming content from their browsers and instead to use their app (where no UOOM historically was effective). Consequently, current GPC users can easily expand the level of protection to their personal data by using both UOOMs simultaneously as they continue to enjoy their daily online habits. Additionally, all other individuals who have not chosen a preferred method, can use OptOutCode to protect their data across both browsers and apps.

2. Compatibility. Individuals can activate GPC by toggling a browser privacy setting or installing an extension for their browser. The browser or extension will automatically send a signal to each website the user visits broadcasting that individual’s preference not to have their data sold or shared, or used for targeted advertising. 

OptOutCode requires individuals to rename their device to include a “0$S” prefix, an operation that can be performed rapidly (i.e. less than 30 seconds if performed manually on iOS or Android smartphone users [link to tutorials] and semi-instantly with a soon-to-be-released SDK). For example, an iPhone user could opt-out of the sale or sharing of their personal data and targeted advertising by changing their phone’s name from “My Phone” to “0$S My Phone”. OptOutCode’s signal does not conflict with GPC’s signal and can easily and equally rapidly be turned off by deleting the prefix from their device’s name.

No conflict between OptOutCode and GPC in any scenario

As we outlined in our original Colorado UOOM submission, since consumers have the right to freely give or revoke consent, a conflict between OptOutCode and Global Privacy Control is, by design, impossible, even within a web browser setting. Specifically, there are four possible scenarios depending on whether a user sets GPC and/or OptOutCode on or off. The matrix below illustrates how those four scenarios should be interpreted