Colorado's Draft Rules for a New Children's Privacy Law

The Colorado Attorney General recently published draft rules implementing a new children’s privacy law in the state. Companies have until September 10 th to comment on the rules. With the new children’s privacy statute going into effect on October 1 st , companies should immediately check for compliance.

The draft rules bear on two central issues, namely when: (i) businesses should have knowledge of a minor’s age (minors are consumers under 18 years old) and (ii) design features are so engaging that a controller’s use of the feature requires consent from the minor.

A. Knowledge Standard.

The rules create a relatively workable set of standards governing when data controllers should know that a user is a minor:

Many triggers of imputed knowledge amount to “actual knowledge,” such