Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I collect browser information from participants in Colorado? What are the requirements?

Collecting Browser Information in Colorado

If you are collecting browser information from participants in Colorado, you may be subject to certain record-keeping and reporting requirements under Colorado law. Specifically, if you collect personal identifying information from a third party, you may be required to retain a written record containing certain information, including the request, the date of the request, whether the request was granted or denied, the name and title of the state agency employee who granted or denied the request, a description of the articulated purpose of the request, the identity of the requestor, and a summary of why the request was granted or denied [1.1].

However, it is important to note that the above requirement applies to state agencies and state agency employees. It is unclear from your query whether you are a state agency or employee. If you are not a state agency or employee, this requirement may not apply to you.

Additionally, if you are collecting browser information from participants in Colorado, you may be subject to certain privacy notice requirements under Colorado law. Specifically, if you are a licensee, you must provide initial, annual, and revised privacy notices that include certain items of information, including the categories of nonpublic personal financial information that you collect and disclose, the categories of affiliates and nonaffiliated third parties to whom you disclose nonpublic personal financial information, your policies and practices with respect to protecting the confidentiality and security of nonpublic personal information, and an explanation of the consumer’s right to opt out of the disclosure of nonpublic personal financial information to nonaffiliated third parties [4.1].

It is important to note that the above requirement applies specifically to nonpublic personal financial information. If you are collecting other types of personal identifying information, different requirements may apply.

Colorado Rules Regarding Electronic Transactions by Colorado Governmental Agencies

If you are a Colorado governmental agency, you must follow the rules regarding electronic transactions as established by the Governor’s Office of Information Technology (“OIT”) [2.1]. These rules identify the covered Colorado governmental agencies, define key terms, and require Colorado governmental agencies follow the policies established by the OIT that: (i) require electronic transactions to be created by an authorized technology in order to be presumed valid; (ii) set forth criteria for determining if a technology is authorized; (iii) identify presently authorized technologies; (iv) provide a mechanism for authorizing new technologies; and (v) establish, approve, monitor and modify security requirements associated with electronic transactions.

Conclusion

If you are not a state agency or employee, you may not be subject to the record-keeping and reporting requirements under Colorado law. However, if you are collecting browser information from participants in Colorado, you may still be subject to certain privacy notice requirements under Colorado law. If you are a Colorado governmental agency, you must follow the rules regarding electronic transactions as established by the Governor’s Office of Information Technology.

Source(s):
Jurisdiction

Colorado