Ask Reggi Your Question Now

Reggi is the free generative AI assistance for regulatory compliance
Ask a Question

Can I use third-party email marketing tools that collect personal information in Colorado? What are the requirements?

Using Third-Party Email Marketing Tools in Colorado

If you are using third-party email marketing tools that collect personal information in Colorado, you must comply with the Colorado Consumer Credit Reporting Act (CCRA) [1.1]. The CCRA regulates the collection, use, and disclosure of nonpublic personal financial information by licensees, which includes financial institutions, insurance companies, and other entities that collect personal information from consumers.

Under Section 12 of the CCRA [1.5], a licensee may not disclose any nonpublic personal financial information about a consumer to a nonaffiliated third party unless the licensee has provided the consumer with an initial notice, an opt-out notice, and a reasonable opportunity to opt-out of the disclosure. However, there are exceptions to this rule, including the exception for service providers and joint marketing under Section 15 [1.1].

If you are using a third-party email marketing tool as a service provider or for joint marketing purposes, you may be exempt from the opt-out requirements under Section 15 of the CCRA [1.1]. To qualify for this exception, you must provide the initial notice in accordance with Section 5, and enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information [1.1].

Additionally, the licensee must ensure that the third party only uses the information for the purposes for which it was disclosed, including use under an exception in Sections 16 or 17 in the ordinary course of business to carry out those purposes [1.1]. If you are using a third-party email marketing tool for joint marketing purposes, the licensee’s contractual agreement with that institution must meet the requirements of Section 15.A.1.b. if it prohibits the institution from disclosing or using the nonpublic personal financial information except as necessary to carry out the joint marketing or under an exception in Sections 16 or 17 in the ordinary course of business to carry out that joint marketing [1.1].

Limits on Sharing Account Number Information for Marketing Purposes

In addition to the CCRA, there are limits on sharing account number information for marketing purposes in Colorado [1.2]. A licensee shall not, directly or through an affiliate, disclose, other than to a consumer reporting agency, a policy number or similar form of access number or access code for a consumer’s policy or transaction account to any nonaffiliated third party for use in telemarketing, direct mail marketing or other marketing through electronic mail to the consumer [1.2]. However, there are exceptions to this rule, including the exception for service providers and joint marketing [1.2].

Conclusion

In summary, if you are using third-party email marketing tools that collect personal information in Colorado, you must comply with the CCRA and the limits on sharing account number information for marketing purposes. If you are using the third-party email marketing tool as a service provider or for joint marketing purposes, you may be exempt from the opt-out requirements under Section 15 of the CCRA. However, you must provide the initial notice in accordance with Section 5, and enter into a contractual agreement with the third party that prohibits the third party from disclosing or using the information other than to carry out the purposes for which the licensee disclosed the information.

Source(s):
Jurisdiction

Colorado