Sacramento, CA — The California Legislature today advanced AB 566, a bill that would require browsers to include a setting that enables a consumer to send an opt-out preference signal. The bill will now go to Governor Newsom’s desk for his signature.
Opt-out preference signals allow a user to persistently signal their intent to exercise their right to opt out of their personal information being shared with third-parties. For example, a user with an opt-out preference signal enabled on their internet browser will automatically send an opt-out request to each website they encounter during a browsing session.
While California consumers enjoy the right to send legally binding opt-out preference signals under the California Consumer Privacy Act (CCPA), major browsers like Chrome, Safari, and Edge, have limited usage of this right by denying native opt-out preference signal functionality. Without access to universal signals, consumers must opt out at each individual website they visit. This bill is therefore vital to ensure that millions of Californians have a practical way to manage their privacy choices under the CCPA.
“It is far too difficult for most people to use their existing privacy rights”, said Matt Schwartz, policy analyst for Consumer Reports. “AB 566 will change that by requiring browser vendors to provide a clear and easy-to-use setting that allows consumers to universally opt-out, preventing their information from being sold or shared with hundreds of third-parties that they have never even heard of. We thank Assemblymember Josh Lowenthal and the California Privacy Protection Agency (CPPA) for their leadership in advancing this critical legislation.
We urge Governor Newsom to sign AB 566 into law and allow Californians to have access to these meaningful privacy controls,” Schwartz added.
The nonprofit, independent organization has been deeply involved in California privacy legislation since the passage of the California Consumer Privacy Act, and has supported other laws to strengthen it, such as the California Privacy Rights Act and the Delete Act
CR is a founding organization of the Global Privacy Control (GPC), a browser-level privacy signal designed to allow Internet users to notify businesses of their preference to not have their data be sold or shared, or used for cross-context behavioral advertising. GPC has been recognized by privacy regulators in California, Colorado, Connecticut, and New Jersey as a legally-binding opt-out signal under those states’ comprehensive privacy laws, and eight other comprehensive state laws also allow consumers to send universal opt-out signals.
This week the CPPA, along with the Attorneys General of California, Colorado, and Connecticut, announced a joint enforcement sweep to investigate potential noncompliance with the GPC. Earlier this year, CR published a report highlighting this very issue.
CR is also working on technical solutions to further empower consumers to take control of their data, including through our app called Permission Slip.