The California Opt Me Out Act will require universal opt-out settings in browsers
Sacramento, CA — California Governor Gavin Newsom signed the groundbreaking California Opt Me Out Act (AB 566) into law today. The first-in-the-nation law will require browsers to include a setting that enables a consumer to send an opt-out preference signal, giving Californians a simple way to exercise their digital privacy rights.
Opt-out preference signals automatically communicate the consumer’s preference not to have their personal information sold or shared with third parties to all of the businesses that a consumer interacts with across a given platform. For example, a user with an opt-out preference signal enabled on their internet browser will automatically send an opt-out request to each website and third party they encounter during a browsing session.
While California consumers already enjoy the right to send legally binding opt-out preference signals under the California Consumer Privacy Act (CCPA), major browsers like Chrome, Safari, and Edge do not offer universal opt-out options in their privacy settings. Without access to universal controls, consumers must opt out at each individual website they visit, or download a third-party extension to send the signal. This new law will provide Californians with a more practical way to manage their privacy choices under the CCPA.
“California continues to lead the way on consumer privacy protection. The California Opt Me Out Act builds on the CCPA by making it far easier for consumers to take advantage of their existing privacy rights in practice,” said Matt Schwartz, policy analyst for Consumer Reports. “For too long, opting out has been a confusing and time intensive process, and many people might not have even realized they can universally opt out. This law will help people protect their personal data by allowing them to simply switch a toggle that tells businesses they can’t sell or share it. We thank Governor Newsom, Assemblymember Josh Lowenthal and the California Privacy Protection Agency (CPPA) for their leadership in getting this critical legislation past the finish line.”
CR has been deeply involved in California privacy legislation since the passage of the California Consumer Privacy Act, and has supported other laws to strengthen it, such as the California Privacy Rights Act and the Delete Act. CR helped lead civil society efforts in support of AB 566. It wrote numerous letters in support of the legislation and delivered thousands of letters from CR members to the Governor.
CR is a founding organization of the Global Privacy Control (GPC), a browser-level privacy signal designed to allow Internet users to notify businesses of their preference to not have their data be sold or shared, or used for cross-context behavioral advertising. GPC has been officially recognized by privacy regulators in California, Colorado, Connecticut, and New Jersey as a legally-binding opt-out signal under those states’ comprehensive privacy laws, and eight other state laws also allow consumers to exercise opt-out requests through universal.
Recently, the CPPA, along with the Attorneys General of California, Colorado, and Connecticut, announced a joint enforcement sweep to investigate potential noncompliance with the GPC. Earlier this year, CR published a report highlighting this very issue.
CR is also working on technical solutions to further empower consumers to take control of their data, including through our app called Permission Slip.
Contact: cyrus.rassool@consumer.org