California Approves Privacy Bill Requiring Opt-Out Tools

California state legislature passed a bill that will require Internet browsers and mobile operating systems to let users opt out of the sale or sharing of their personal information. The bill now heads to California Governor Gavin Newsom for his signature.

The California Consumer Privacy Act already gave state residents the right to send legally binding opt-out requests to companies, but the new bill will require that browser and mobile operating systems provide a mechanism to send these opt-out preference signals. Users would be able to opt out of sharing information by selecting this signal on their Internet browser and operating system, and the browser would automatically sent out opt-out requests to every site and app the user visits, by default.

At the moment, browsers such as Google Chrome, Apple's Safari, and Microsoft's Edge, along with Android and iOS mobile platforms, currently lack these tools, meaning that users need to download third-party software in order to send opt-out preference signals.

The language of the bill, which was approved by both the state Senate and Assembly last week, says the method of activating the opt-out process needs to be "easy for a reasonable person to locate and configure."

The bill's advancement was heralded by the California Privacy Protection Agency. At its Dec. 8, 2023 board meeting, the agency noted that browsers that natively support opt-out preference signals (Mozilla Firefox, DuckDuckGo, and Brave) currently make up less than 10% of the global desktop browser market.

"We thank the Legislature for passing AB 3048, a landmark bill that makes it significantly easier for Californians to exercise their opt–out rights online," CPPA executive director Ashkan Soltani said in a statement. "This is another example of California innovating to protect consumers and promote trust in the digital marketplace."

While this is a state law applying only to California residents, the required changes in browsers and operating systems mean this opt-out mechanism will be available for all users.