We continue our State AG webinar series traveling farther west past the Great Plains to the Rocky Mountains in Colorado. Last week, we spoke with Colorado Attorney General Phil Weiser and Deputy Attorney General for Consumer Protection, Nathan Blake, and covered a wide range of topics from the office’s structure, to the Colorado Privacy Act, to artificial intelligence (AI), and teen mental health. We recap highlights of what we learned below.

Background and Priorities of the Office

Given Colorado’s larger size and what AG Weiser called a “range of inputs” including from the legislature and the public, the Consumer Protection Section is comprised of many specialized teams including an opioids unit, a utilities consumer advocate unit, a consumer credit codes unit (where the office plays a supervisory role in non-bank lending), and a civil rights and corporate fraud unit. The section also encompasses traditional consumer protection issues such as consumer fraud and antitrust. For example, in response to public outcry and legislative concerns, the office is actively reviewing student loans, fees, and student loan servicing as potential areas of deception and consumer harm.

Like most states, the office also uses consumer complaints filed with the office to inform its priorities. While Colorado’s complaints were historically not public, the office started a pilot program about a year and a half ago to forward complaints to some businesses for resolution. An expansion of this program should increase business’ awareness of potential issues as they arise.

Collaboration with States

Colorado has a robust history of participating in multistate consumer investigations. AG Weiser touted the multistate’s ability to create a comparative advantage and leverage the distinct strengths and resources of each state. “We’re better together,” he said. Moreover, states may provide a more efficient and streamlined settlement for businesses that are involved in nationwide investigations.

Price Gouging & Auto-Renewals

AG Weiser noted that in addition to its general UDAP law, the Colorado Consumer Protection Act, the office enforces specific consumer protection laws related to topics such as price gouging and auto-renewal charges. Under Colorado’s price gouging statute, it an “unfair and unconscionable act” when “a person charges a price so excessive as to amount to price gouging.” AG Weiser emphasized that the statute relies on a reasonableness standard which is based on comparison with the market. AG Weiser hypothesized that if there is a fire in Boulder County, if people are looking for a place to the stay that night, it’s understandable that the average will go up a little for the hotels. However, if one hotel charges $2,000 extra because they know they can take advantage of a family’s dire situation, AG Weiser identified that actor as an “opportunistic seller” who is violating Colorado’s price gouging laws. He said it is important to note that, like with many states, there has to be a declared state of emergency to trigger price gouging laws.

Auto-renewals have also been a hot topic in Colorado (as with many state and federal enforcers) as a specific Colorado law took effect in 2022. Mr. Blake emphasized the state’s commitment to enforce the recent statute and noted some of the more unique aspects, such as requirements for monthly subscriptions to provide annual reminder notices to consumers.

Colorado Privacy Act

AG Weiser stressed “if you’re a business today, and you’re not thinking about data, you need to wake up.” Colorado was the third state to pass a comprehensive privacy law. With the law now in effect, the office is paying particular attention to how businesses are reacting and adapting. AG Weiser provided some historical context to the law and noted that the CPA was intended to be “principle based” and not “prescriptive” with the knowledge that “technology changes and we need to have an adaptable regime.” Importantly, the office wants to focus its attention on businesses committing “flagrant fouls and not ticky tack fouls. If you’re trying and make a mistake, that’s okay, but if you’re deliberately thumbing your nose at the law? Not okay.”

Mr. Blake discussed Colorado’s thoughtful approach to regulatory process and rulemaking describing it as an extensive, collaborate, and transparent process to develop the rules that went into effect July 1. Blake said Colorado’s commitment is to continue in the spirit of collaborative rulemaking for consumers, members of industry, and sister states. AG Weiser added that the rulemaking process was critical to the CPA. The office started with informal stakeholder process, then issued model rules, received comments, and by the end of the process evaluated the comments and made adjustments prior to issuing final rules.

The office has conducted significant outreach to the business community to maintain the transparent approach to implementing the CPA. Mr. Blake discussed how the office sent a series of letters to businesses informing them of their duties under the CPA after the bulk of the rulemaking process was finished, the purpose of which he explained was to inform them that the law was in effect and what they can anticipate.

As we’ve previously reported, the CPA provides Colorado residents with the right to opt out of use of personal data for sale and targeted profiling, and next year they will have the right to use a universal opt out mechanism. The CPA also imposes a data minimization requirement and mandates covered businesses conduct data protection impact assessments before conducting data processing activities that present a heightened risk to consumers.

Mr. Blake stated that the office welcomes questions. Though the AG office does not answer individual questions, the office considers the questions for FAQs or future rulemaking. The office intends on releasing an FAQ in the coming months, with additional guidance on the universal opt out requirement going into effect July 1, 2024.

Artificial Intelligence

As AG Weiser’s office has discussed before, AI is a hot topic for state and federal agencies. AG Weiser stressed that not having the rules of the road for AI poses some potentially significant risks for our whole society. He stated that one of most important functions of consumer protection law is to build trust with consumers. If bad actors are not held accountable for harming consumers, then the overall trust environment is undermined for everyone. As such, AG Weiser worked with other states to issue a letter to the National Telecommunications and Information Administration (NTIA) and also gave a speech in front of the Federal Circuit Bar Association addressing his concerns for AI and its potential harms. Colorado has some tools available to curb potential harms from AI such as requirements for risk assessments and transparency under the CPA.

Mr. Blake added that AI could pose a risk of accelerating discriminatory practices. However, even without specifically tailored AI statutes, UDAP (unfair deceptive acts and practices) laws provide flexibility to law enforcement to deal with AI and other new technologies that create consumer harm.

Teen Mental Health

AG Weiser, like many of his AG colleagues, has made teen mental health a priority. He described concerns that social media increases engagement with dark content that negatively impacts teen mental health. AG Weiser said that the office evaluated its tools available such as the Children’s Online Privacy Protection Act (COPPA), but noted it falls short in only protecting children under 13 years of age, leaving teenagers unprotected. Mr. Blake added that the challenge is to assess whether these companies broke the law when it came to this teen mental health crisis. As Colorado’s investigation proceeds, the office will consider potential avenues for justice and rectification.

Join Kelley Drye’s State Attorneys General Ad Law Team for the next program in the 2023 State Attorneys General Webinar Series featuring Illinois Attorney General Kwame Raoul and his Consumer Protection Chief Susan Ellis on August 29 at 2:00 ET. Register here.

State AGs and Consumer Protection: What We Learned from . . . Colorado