Page 149 - GDPR and US States General Privacy Laws Deskbook

b.  Example: If multiple choices are offered to a Consumer, it should be equally easy to accept or reject all options.
Presenting the option to “accept all” when offering a Consumer the choice to Consent to the use of Sensitive Data
for multiple purposes without an option to “reject all” would not be considered equal or symmetrical.
2.  Consent choice options should avoid the use of emotionally manipulative language or visuals to unfairly, fraudulently,
or deceptively coerce or steer Consumer choice or Consent.
a.  Example: One choice should not be presented in a way that creates unnecessary guilt or shames the user into
selecting a specific choice. Presenting the choices “I accept, I want to help endangered species” vs “No, I don’t care
about animals” may be considered unfairly emotionally manipulative.
b.  Example: The explanation of the choice to Consumers should not include gratuitous information to emotionally
manipulate Consumers. Explaining that a mobile application “helps save lives” when asking for Consent to collect
Sensitive Data for Targeted Advertising may be considered deceptively emotionally manipulative if the Targeted
Advertising is not critical to the lifesaving functionality of the application.
3. A Consumer’s silence or failure to take an affirmative action should not be interpreted as acceptance or Consent.
a.  Example: A Consumer closing a pop-up window which requests Consent without first affirmatively selecting the
equivalent of an “I accept” button should not be interpreted as Consent.
b.  Example: A Consumer navigating forward on a webpage after a Consent choice has been presented without selecting
the equivalent of an “I accept” button should not be interpreted as affirmative Consent.
c.  Example: A Consumer continuing to use a Smart TV without replying “I accept” or “I consent” in reply to a verbal
request for Consent should not be interpreted as affirmative Consent.
4.  Consent choice options should not be presented with a preselected or default option.
a.  Example: Checkboxes or radio buttons should not be selected automatically when presented to a Consumer.
5.  A Consumer should be able to select either Consent choice option within a similar number of steps. A Consumer’s ability
to exercise a more privacy-protective option shall not be unduly longer, more difficult, or time-consuming than the path
to exercise a less privacy-protective option.
a.  Example: Consumers should be presented with all choices at the same time. Presenting an “I accept” button next to
a “Learn More” button which requires Consumers to take an extra step before they are given the option of an “I do
not accept” button could be considered an unnecessary restriction.
b.  Example: Describing the choice before Consumers and placing both the “I accept” and “I do not accept” buttons after
a “select preferences” button would not be considered an unnecessary restriction.
6.  A Consumer’s expected interaction with a website, application, or product should not be unnecessarily interrupted or
intruded upon to request Consent.
a.  Example: Consumers should not be interrupted multiple times in one visit to a website to Consent if they have
declined the Consent choice offered when they arrived at the page.
b.  Example: Consumers should not be redirected away from the content or service they are attempting to interact with
because they declined the Consent choice offered, unless Consent to process the requested data is strictly necessary
to provide the website or application content or experience.
149 | Colorado Privacy Act Rules