The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. The bill would make these provisions operative on January 1, 2026.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal signal, as defined, to businesses with which the consumer interacts through the browser and would, only upon 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, through which a consumer interacts with a business that does not include a setting that enables the a consumer to send an opt-out preference signal to that business. businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. The bill would make these provisions operative on January 1, 2026.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business businesses with which the consumer interacts through the browser and would would, only upon adoption of certain regulations by the agency, prohibit a business from developing or maintaining a device mobile operating system, as defined, through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations adopted by the California Privacy Protection Agency. business. The bill would also authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and device mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser through which a consumer interacts with a business that does not include a setting that enables the a consumer to send an opt-out preference signal to that a business with which the consumer interacts through the browser and would prohibit a business from developing or maintaining a device through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations adopted by the California Privacy Protection Agency. The bill would also authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and device to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency (agency) and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business and would prohibit a business from developing or maintaining a device through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations adopted by the California Privacy Protection Agency. The bill would also authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and device to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

GOVERNOR'S VETO

GV Bill Id:AB 3048

Author:(Lowenthal)

As Enrolled Ver:August 31, 2024

2/3 vote

SUMMARY

Requires that internet browsers and mobile operating systems include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information.

Senate Amendments:

1. Clarify that the requirement for browsers to offer opt-out preference signals applies only when not otherwise prohibited by federal law.
2. Replace language requiring opt-out preference signals to be "easy for a reasonable person to locate and enable" with language stating that they must be "easy for a reasonable person to locate and configure," to more accurately describe how consumers interact with these signals.
3. Conform the structure of the requirement for mobile operating systems to offer opt-out preference signals with that of the requirement for browsers.
4. Give covered businesses six additional months to comply with the mobile operating system requirement.
5. Delay the effective date until January 1, 2026.
6. Replace references to "device" with "mobile operating system" and adds a definition of a mobile operating system.

Governor’s Veto Message

This bill would require internet browsers and mobile operating systems to include a setting that California consumers can use to signal to businesses with which they interact that they wish to, first, opt out of the sale or sharing of their personal information, and second, limit use of their sensitive personal information.

I share the author's desire to enhance consumer privacy. Last year, I signed SB 362 (Becker), which requires the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information.

I am concerned, however, about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

COMMENTS

An opt-out preference signal, such as Global Privacy Controls (GPC), are a signal that is sent by a third-party platform on behalf of the consumer that communicates the consumer's choice to opt out of the sale and sharing of their personal information. Essentially, these signals are a way for users to communicate privacy preferences to a host of websites by using a specific search engine or browser plug-in rather than having to manually indicate the user's preferences on each website the user visits. Upon receiving this signal, websites cannot sell or share the consumer's personal information absent some affirmative action from the consumer granting permission to the respective website.

This bill, sponsored by the California Privacy Protection Agency, is intended to make it easier for consumers to limit the amount of personal information being collected every time they search for anything on the internet. In his letter of support, the executive director of the Privacy Agency, Ashkan Soltani, states, "Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business."

According to the author, in order to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, currently consumers must either use one of the few browsers that support an opt-out preference signal or take additional steps to locate and download a third-party browser plugin that adds support for such signals. As of the writing of this analysis, only Mozilla Firefox, DuckDuckGo, and Brave offer support for opt-out preference signals, which, together, make up less than 10% of the overall global desktop browser market share.

The operators of the world's largest internet browsers, most notably, Alphabet who owns Chrome, Apple that runs Safari, and Microsoft that operates Edge, have declined to adopt an opt-out preference signal to allow users of their browser to indicate they do not want their personal information sold or shared by any URL they visit while using the browser. These companies make up over 90% of the desktop browser market and also rely on advertising business models for their revenue, perhaps making it unlikely that they will voluntarily create an opt-out signal on their browsers. Because of this reality, the purpose this bill is to require all businesses with internet browsers used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

Oakland Privacy, writing in support of the bill, explains:

The current version of the CPRA contains an overly complicated set of alternative options that, while they apparently seemed desirable during the drafting phase, have not made opting out easy or simple for users. Anyone browsing the Internet nowadays is aware of the endless series of opt-out windows presented in varying styles, formats and places by virtually every website they visit. It is a rare internet user who does not mumble in exasperation that they wish they could just check it once and have it apply to all websites.

Arguments in Opposition

A coalition of opponents, including TechNet and the California Chamber of Commerce argue:

AB 3048 will upend the balanced approach taken by voters, removing any such flexibility in the law. Yet it does not account for any of the myriad issues raised by mandating global privacy controls. For example, it does not permit consumers to reverse their decision and opt-back in if they so choose, both as a general matter and for specific use cases for specific businesses as well. Nor does it provide any clarity on how businesses can provide consumers who have previously indicated they wish to opt out via the signal with the opportunity to consent to the sale and sharing of their PI or the use and disclosure of their sensitive PI with that business, specifically.

FISCAL COMMENTS

According to the Appropriations Committee analysis:

Minor and absorbable costs to the California Privacy Protection Agency to issue regulations and enforce the opt-out preference signal requirement.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 8-3-0

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

NO: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

NO: Sanchez, Dixon, Jim Patterson, Ta

ASSEMBLY FLOOR: 53-7-20

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Gabriel, Garcia, Gipson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO: Davies, Dixon, Vince Fong, Hoover, Sanchez, Ta, Wallis

ABS, ABST OR NV: Alanis, Bains, Calderon, Cervantes, Chen, Megan Dahle, Essayli, Flora, Friedman, Gallagher, Grayson, Holden, Lackey, Mathis, Jim Patterson, Joe Patterson, Petrie-Norris, Luz Rivas, Soria, Valencia

SENATE FLOOR: 31-7-2

YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Laird, Limón, McGuire, Menjivar, Min, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

NO: Alvarado-Gil, Dahle, Grove, Jones, Nguyen, Ochoa Bogh, Seyarto

ABS, ABST OR NV: Newman, Niello

ASSEMBLY FLOOR: 59-12-8

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Flora, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, Mathis, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Valencia, Villapudua, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO: Alanis, Chen, Megan Dahle, Davies, Dixon, Gallagher, Lackey, Jim Patterson, Sanchez, Ta, Waldron, Wallis

ABS, ABST OR NV: Bains, Cervantes, Essayli, Grayson, Hoover, Ortega, Joe Patterson, Soria

UPDATED

VERSION: August 31, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0005132

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 3048

Author:(Lowenthal)

As Amended Ver:August 23, 2024

Majority vote

SUMMARY

Requires that internet browsers and mobile operating systems include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information.

Senate Amendments

1. Clarify that the requirement for browsers to offer opt-out preference signals applies only when not otherwise prohibited by federal law.
2. Replace language requiring opt-out preference signals to be “easy for a reasonable person to locate and enable” with language stating that they must be "easy for a reasonable person to locate and configure," to more accurately describe how consumers interact with these signals.
3. Conform the structure of the requirement for mobile operating systems to offer opt-out preference signals with that of the requirement for browsers.
4. Give covered businesses six additional months to comply with the mobile operating system requirement.
5. Delay the effective date until January 1, 2026.
6. Replace references to “device” with “mobile operating system” and adds a definition of a mobile operating system.

COMMENTS

An opt-out preference signal, such as Global Privacy Controls (GPC), are a signal that is sent by a third-party platform on behalf of the consumer that communicates the consumer’s choice to opt out of the sale and sharing of their personal information. Essentially, these signals are a way for users to communicate privacy preferences to a host of websites by using a specific search engine or browser plug-in rather than having to manually indicate the user’s preferences on each website the user visits. Upon receiving this signal, websites cannot sell or share the consumer’s personal information absent some affirmative action from the consumer granting permission to the respective website.

This bill, sponsored by the California Privacy Protection Agency, is intended to make it easier for consumers to limit the amount of personal information being collected every time they search for anything on the internet. In his letter of support, the executive director of the Privacy Agency, Ashkan Soltani, states, “Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business.”

According to the author, in order to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, currently consumers must either use one of the few browsers that support an opt-out preference signal or take additional steps to locate and download a third-party browser plugin that adds support for such signals. As of the writing of this analysis, only Mozilla Firefox, DuckDuckGo, and Brave offer support for opt-out preference signals, which, together, make up less than 10% of the overall global desktop browser market share.

The operators of the world’s largest internet browsers, most notably, Alphabet who owns Chrome, Apple that runs Safari, and Microsoft that operates Edge, have declined to adopt an opt-out preference signal to allow users of their browser to indicate they do not want their personal information sold or shared by any URL they visit while using the browser. These companies make up over 90% of the desktop browser market and also rely on advertising business models for their revenue, perhaps making it unlikely that they will voluntarily create an opt-out signal on their browsers. Because of this reality, the purpose this bill is to require all businesses with internet browsers used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

Oakland Privacy, writing in support of the bill, explains:

The current version of the CPRA contains an overly complicated set of alternative options that, while they apparently seemed desirable during the drafting phase, have not made opting out easy or simple for users. Anyone browsing the Internet nowadays is aware of the endless series of opt-out windows presented in varying styles, formats and places by virtually every website they visit. It is a rare internet user who does not mumble in exasperation that they wish they could just check it once and have it apply to all websites.

Arguments in Opposition

A coalition of opponents, including TechNet and the California Chamber of Commerce argue:

AB 3048 will upend the balanced approach taken by voters, removing any such flexibility in the law. Yet it does not account for any of the myriad issues raised by mandating global privacy controls. For example, it does not permit consumers to reverse their decision and opt-back in if they so choose, both as a general matter and for specific use cases for specific businesses as well. Nor does it provide any clarity on how businesses can provide consumers who have previously indicated they wish to opt out via the signal with the opportunity to consent to the sale and sharing of their PI or the use and disclosure of their sensitive PI with that business, specifically.

FISCAL COMMENTS

According to the Appropriations Committee analysis:

Minor and absorbable costs to the California Privacy Protection Agency to issue regulations and enforce the opt-out preference signal requirement.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 8-3-0

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

NO: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

NO: Sanchez, Dixon, Jim Patterson, Ta

ASSEMBLY FLOOR: 53-7-20

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Gabriel, Garcia, Gipson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO: Davies, Dixon, Vince Fong, Hoover, Sanchez, Ta, Wallis

ABS, ABST OR NV: Alanis, Bains, Calderon, Cervantes, Chen, Megan Dahle, Essayli, Flora, Friedman, Gallagher, Grayson, Holden, Lackey, Mathis, Jim Patterson, Joe Patterson, Petrie-Norris, Luz Rivas, Soria, Valencia

SENATE FLOOR: 31-7-2

YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dodd, Durazo, Eggman, Glazer, Gonzalez, Hurtado, Laird, Limón, McGuire, Menjivar, Min, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

NO: Alvarado-Gil, Dahle, Grove, Jones, Nguyen, Ochoa Bogh, Seyarto

ABS, ABST OR NV: Newman, Niello

UPDATED

VERSION: August 23, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004881

 THIRD READING  

Bill No: AB 3048

Author: Lowenthal (D)

Amended: 8/23/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 10-0, 7/2/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Roth, Stern, Wahab

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 53-7, 5/22/24 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SOURCE: California Privacy Protection Agency

DIGEST:

This bill requires browsers and mobile operating systems to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts.

Senate Floor Amendments of 8/23/24 clarify the bill’s interoperation with federal law, delay the operative date of a provision, and make technical changes.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Prohibits, unless otherwise prohibited by federal law, a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and configure.
2. Prohibits a business from developing or maintaining a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. This section becomes operative six months after the adoption of regulations by the PPA that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.
3. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
4. Defines “browser” to mean an interactive software application that is primarily used by consumers to access internet websites. Defines “mobile operating system” as an operating system in use on a smartphone or tablet. “Opt-out preference signal” means a signal that complies with this title and that communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information or to limit the use of the consumer’s sensitive personal information.
5. Delays the operative date, except as specified above, to January 1, 2026.
6. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA.

Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and configure. Six months after regulations are promulgated by the PPA, businesses are also prohibited from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal.

This bill is sponsored by the PPA. It is supported by a number of privacy and consumer advocacy groups, including the Center for Digital Democracy and Consumer Reports. It is opposed by a host of industry coalitions, including TechNet.

Comments

Author’s statement. According to the author, “Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.”

Providing tools to effectuate consumer rights. Despite the right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Previous attempts have been made to achieve this sort of mechanism, including when nearly all major browser vendors adopted “Do Not Track,” a technology that allowed consumers to transmit “Do Not Track” requests to businesses via their web browser. However, there was no legal requirement to honor these signals.

More recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

The author argues that now that California businesses receiving opt-out preference signals are required to honor them under the CCPA, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and enable. To ensure this effectuates the goals of the browser requirement, this bill further prohibits a business from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations to be adopted. This latter provision takes effect once those regulations have been promulgated. This bill authorizes the PPA to adopt those regulations.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 8/26/24)

California Privacy Protection Agency (source)
Accountable Tech

ACLU California Action

Brave Software

CALPIRG

Center for Democracy and Technology

Center for Digital Democracy

Concept Art Association

Consumer Federation of America

Consumer Reports

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center

Oakland Privacy

Privacy Researchers and Academics

Privacy Rights Clearinghouse

OPPOSITION: (Verified 8/26/24)

American Association of Advertising Agencies

Association of National Advertisers

California Chamber Commerce

California Land Title Association

California Mortgage Bankers Association

California Retailers Association

Civil Justice Association of California

Computer and Communications Industry Association

Insights Association

Internet Coalition

Los Angeles Area Chamber of Commerce

TechNet

ARGUMENTS IN SUPPORT: The California Privacy Protection Agency, the sponsor, writes:

Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement. Once enabled through the browser, businesses receiving these opt-out preference signals are required under California law to honor them as an opt out.

However, to exercise this right under California law, consumers must either use a browser that supports an opt-out preference signal, or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals. To date, only a limited number of browsers offer native support for opt-out preference signals: Mozilla Firefox, DuckDuckGo, and Brave. Together, they make up less than 10% of the overall global desktop browser market share. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share —have declined to offer these signals, although these companies are also heavily reliant on advertising business models. No device operating system has yet implemented support for opt-out preference signals.

ARGUMENTS IN OPPOSITION: An industry coalition, including the Civil Justice Association of California writes:

AB 3048 will upend the balanced approach taken by voters, removing any such flexibility in the law. Yet it does not account for any of the myriad issues raised by mandating global privacy controls. For example, it does not permit consumers to reverse their decision and opt-back in if they so choose, both as a general matter and for specific use cases for specific businesses as well. Nor does it provide any clarity on how businesses can provide consumers who have previously indicated they wish to opt out via the signal with the opportunity to consent to the sale and sharing of their PI or the use and disclosure of their sensitive PI with that business, specifically. It also fails to ensure that opt-out signals avoid default settings and or to promote informed choices about how they interact with applications and websites by authorizing businesses to notify consumers of both the benefits and consequences of opting-out and the use of cookies.

ASSEMBLY FLOOR: 53-7, 5/22/24

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Gabriel, Garcia, Gipson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NOES: Davies, Dixon, Vince Fong, Hoover, Sanchez, Ta, Wallis

NO VOTE RECORDED: Alanis, Bains, Calderon, Cervantes, Chen, Megan Dahle, Essayli, Flora, Friedman, Gallagher, Grayson, Holden, Lackey, Mathis, Jim Patterson, Joe Patterson, Petrie-Norris, Luz Rivas, Soria, Valencia

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/26/24 17:01:33

**** END ****

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of Aug. 6, 2024]. ↑

 THIRD READING  

Bill No: AB 3048

Author: Lowenthal (D)

Amended: 7/3/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 10-0, 7/2/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Roth, Stern, Wahab

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 53-7, 5/22/24 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SOURCE: California Privacy Protection Agency

DIGEST:

This bill requires browsers to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and enable.
2. Prohibits a business from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business. This section becomes operative only upon the adoption of regulations by the PPA that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.
3. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
4. Defines “browser” to mean an interactive software application that is primarily used by consumers to access internet websites. Defines “mobile operating system” as an operating system in use on a smartphone or tablet.
5. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA.

Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and enable. Once regulations are promulgated by the PPA, businesses are also prohibited from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal.

This bill is sponsored by the PPA. It is supported by a number of privacy and consumer advocacy groups, including the Center for Digital Democracy and Consumer Reports.

Comment

Author’s statement. According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Providing tools to effectuate consumer rights. Despite the right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Previous attempts have been made to achieve this sort of mechanism, including when nearly all major browser vendors adopted “Do Not Track,” a technology that allowed consumers to transmit “Do Not Track” requests to businesses via their web browser. However, there was no legal requirement to honor these signals.

More recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

The author argues that now that California businesses receiving opt-out preference signals are required to honor them under the CCPA, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and enable. To ensure this effectuates the goals of the browser requirement, this bill further prohibits a business from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations to be adopted. This latter provision takes effect once those regulations have been promulgated. This bill authorizes the PPA to adopt those regulations.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 8/6/24)

California Privacy Protection Agency (source)
Accountable Tech

ACLU California Action

Brave Software

CALPIRG

Center for Democracy and Technology

Center for Digital Democracy

Concept Art Association

Consumer Federation of America

Consumer Reports

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center

Oakland Privacy

Privacy Researchers and Academics

Privacy Rights Clearinghouse

OPPOSITION: (Verified 8/6/24)

American Association of Advertising Agencies

Association of National Advertisers

California Chamber Commerce

California Land Title Association

California Mortgage Bankers Association

California Retailers Association

Civil Justice Association of California

Computer and Communications Industry Association

Insights Association

Internet Coalition

Los Angeles Area Chamber of Commerce

TechNet

ARGUMENTS IN SUPPORT: The California Privacy Protection Agency, the sponsor, writes:

Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement. Once enabled through the browser, businesses receiving these opt-out preference signals are required under California law to honor them as an opt out.

However, to exercise this right under California law, consumers must either use a browser that supports an opt-out preference signal, or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals. To date, only a limited number of browsers offer native support for opt-out preference signals: Mozilla Firefox, DuckDuckGo, and Brave. Together, they make up less than 10% of the overall global desktop browser market share. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share —have declined to offer these signals, although these companies are also heavily reliant on advertising business models. No device operating system has yet implemented support for opt-out preference signals.

ASSEMBLY FLOOR: 53-7, 5/22/24

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Gabriel, Garcia, Gipson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NOES: Davies, Dixon, Vince Fong, Hoover, Sanchez, Ta, Wallis

NO VOTE RECORDED: Alanis, Bains, Calderon, Cervantes, Chen, Megan Dahle, Essayli, Flora, Friedman, Gallagher, Grayson, Holden, Lackey, Mathis, Jim Patterson, Joe Patterson, Petrie-Norris, Luz Rivas, Soria, Valencia

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/19/24 10:13:08

**** END ****

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of Aug. 6, 2024]. ↑

 THIRD READING  

Bill No: AB 3048

Author: Lowenthal (D)

Amended: 7/3/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 10-0, 7/2/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Roth, Stern, Wahab

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 53-7, 5/22/24 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SOURCE: California Privacy Protection Agency

DIGEST:

This bill requires browsers to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act of 2018 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and enable.
2. Prohibits a business from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business. This section becomes operative only upon the adoption of regulations by the PPA that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.
3. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
4. Defines “browser” to mean an interactive software application that is primarily used by consumers to access internet websites. Defines “mobile operating system” as an operating system in use on a smartphone or tablet.
5. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA.

Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and enable. Once regulations are promulgated by the PPA, businesses are also prohibited from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal.

This bill is sponsored by the PPA. It is supported by a number of privacy and consumer advocacy groups, including the Center for Digital Democracy and Consumer Reports.

Comment

Author’s statement. According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Providing tools to effectuate consumer rights. Despite the right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Previous attempts have been made to achieve this sort of mechanism, including when nearly all major browser vendors adopted “Do Not Track,” a technology that allowed consumers to transmit “Do Not Track” requests to businesses via their web browser. However, there was no legal requirement to honor these signals.

More recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

The author argues that now that California businesses receiving opt-out preference signals are required to honor them under the CCPA, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and enable. To ensure this effectuates the goals of the browser requirement, this bill further prohibits a business from developing or maintaining a mobile operating system through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations to be adopted. This latter provision takes effect once those regulations have been promulgated. This bill authorizes the PPA to adopt those regulations.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

SUPPORT: (Verified 8/6/24)

California Privacy Protection Agency (source)
Accountable Tech

ACLU California Action

Brave Software

CALPIRG

Center for Democracy and Technology

Center for Digital Democracy

Concept Art Association

Consumer Federation of America

Consumer Reports

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center

Oakland Privacy

Privacy Researchers and Academics

Privacy Rights Clearinghouse

OPPOSITION: (Verified 8/6/24)

None received

ARGUMENTS IN SUPPORT: The California Privacy Protection Agency (PPA), the sponsor, writes:

Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement. Once enabled through the browser, businesses receiving these opt-out preference signals are required under California law to honor them as an opt out.

However, to exercise this right under California law, consumers must either use a browser that supports an opt-out preference signal, or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals. To date, only a limited number of browsers offer native support for opt-out preference signals: Mozilla Firefox, DuckDuckGo, and Brave. Together, they make up less than 10% of the overall global desktop browser market share. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share —have declined to offer these signals, although these companies are also heavily reliant on advertising business models. No device operating system has yet implemented support for opt-out preference signals.

ASSEMBLY FLOOR: 53-7, 5/22/24

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Gabriel, Garcia, Gipson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Ting, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NOES: Davies, Dixon, Vince Fong, Hoover, Sanchez, Ta, Wallis

NO VOTE RECORDED: Alanis, Bains, Calderon, Cervantes, Chen, Megan Dahle, Essayli, Flora, Friedman, Gallagher, Grayson, Holden, Lackey, Mathis, Jim Patterson, Joe Patterson, Petrie-Norris, Luz Rivas, Soria, Valencia

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/7/24 13:38:49

**** END ****

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of Aug. 6, 2024]. ↑

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 3048 (Author:Lowenthal)

Version: April 10, 2024

Hearing Date: July 2, 2024

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Consumer Privacy Act of 2018: opt-out preference signal

DIGEST

This bill requires browsers to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts.

EXECUTIVE SUMMARY

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA).

Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and enable.

This bill is sponsored by the California Privacy Protection Agency. It is supported by a number of privacy and consumer advocacy groups, including the Center for Digital Democracy and Consumer Reports. No timely opposition was received.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Prohibits a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and enable.
2. Prohibits a business from developing or maintaining a device through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations adopted by the PPA.
3. Authorizes the PPA to adopt regulations as necessary to implement and administer this law, including to update the definitions of “browser” and “device” to address changes in technology, data collection, obstacles to implementation, or privacy concerns.
4. Defines “browser” to mean an interactive software application that is primarily used by consumers to access internet websites.
5. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

COMMENTS

1. California’s landmark privacy protection law

As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct.

The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells or shares personal information to third parties is required to notify consumers that this information may be sold or shared and that they have the right to opt out of such sales. (Civ. Code § 1798.120(b).)

1. Providing tools to effectuate consumer rights

Despite this right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Previous attempts have been made to achieve this sort of mechanism, including when nearly all major browser vendors adopted “Do Not Track,” a technology that allowed consumers to transmit “Do Not Track” requests to businesses via their web browser. However, there was no legal requirement to honor these signals.

More recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice (DOJ) included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

The author argues that now that California businesses receiving opt-out preference signals are required to honor them under the CCPA, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and enable. To ensure this effectuates the goals of the browser requirement, the bill further prohibits a business from developing or maintaining a device through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business pursuant to regulations. The bill authorizes the PPA to adopt regulations.

Several stakeholders expressed concerns with the scope of the bill. In response, the author has agreed to narrow the scope by replacing “device” in Section 1798.136(b) with “smartphone operating system,” defined as an operating system used by mobile devices, such as smartphones or tablets. In addition, the author will take amendments that delay the effective date of this provision until the PPA is able to promulgate regulations that outline the requirements and technical specifications. Additional amends to provide clarity have also been agreed to.

According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

In response to feedback from stakeholders, the author has agreed to amendments that narrow the application of the bill to apply to a “mobile operating system” rather than a “device.” In addition, the amendments provide that the restriction on businesses to not develop or maintain such a system without the specified setting only becomes operative upon the adoption of relevant regulations by the PPA, and further clarify the scope of those regulations.

1. Stakeholder positions

This bill is sponsored by the PPA, which writes:

Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020. The CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement. Once enabled through the browser, businesses receiving these opt-out preference signals are required under California law to honor them as an opt out.

However, to exercise this right under California law, consumers must either use a browser that supports an opt-out preference signal, or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals. To date, only a limited number of browsers offer native support for opt-out preference signals: Mozilla Firefox, DuckDuckGo, and Brave. Together, they make up less than 10% of the overall global desktop browser market share. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share —have declined to offer these signals, although these companies are also heavily reliant on advertising business models. No device operating system has yet implemented support for opt-out preference signals.

A coalition of groups in support, including the Center for Digital Democracy and the Electronic Privacy Information Center, write:

AB 3048 will ensure that consumers have the ability to use their privacy rights by requiring that browser vendors and suppliers of devices (for example, a mobile device or “smart” TV) include an easy to locate and use setting that enables the consumer to send an opt-out preference signal. This bill’s approach will help reduce opt-out friction and make it easier for California residents to control their data, while also providing for flexibility by allowing the CPPA to adopt rules that will allow the law to keep pace with technology.

1. Furthering the purpose and intent of the CPRA

Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:

• consumers should know who is collecting their personal information;
• consumers should have control over how their personal information is used; and
• consumers should benefit from businesses’ use of their personal information.

Section 3 also includes a series of responsibilities that businesses should have. These include:

• businesses should specifically and clearly inform consumers about how they use personal information; and
• businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.

Section 3 also lays out various guiding principles about how the law should be implemented.

The bill ensures a pathway for consumers to more effectively exercise their rights under the CCPA. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”

SUPPORT

California Privacy Protection Agency (sponsor)
Accountable Tech

ACLU California Action

Brave Software

CALPIRG

Center for Democracy and Technology

Center for Digital Democracy

Concept Art Association

Consumer Federation of America

Consumer Reports

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center (EPIC)

Oakland Privacy

Privacy Researchers and Academics

Privacy Rights Clearinghouse

OPPOSITION

None received

RELATED LEGISLATION

Pending Legislation:

SB 1223 (Becker, 2024) includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the CCPA. SB 1223 is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1824 (Valencia, 2024) requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the CCPA. AB 1824 is currently on the Senate Floor.

AB 1949 (Wick, 2024) prohibits the collection, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. The bill provides for regulations to be promulgated by the PPA. AB 1949 is currently in this Committee.

AB 2013 (Irwin, 2024) requires developers of AI systems or services that are made available for Californians to use to post on their website documentation regarding the data used to train the system or service, including high-level summaries of the datasets used. AB 2013 is currently in this Committee.

AB 2877 (Bauer-Kahan, 2024) prohibits CCPA covered-businesses that are the developers of AI systems or tools from using the personal information of consumers under the age of 16 to train AI systems or services without first obtaining affirmative authorization, and even with such authorization the data must be de-identified and aggregated before it is used to train. AB 2877 is currently in the Senate Appropriations Committee.

Prior Legislation:

AB 947 (Gabriel, Ch. 551, Stats. 2023) included personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.

AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provided stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.

AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.

PRIOR VOTES:

Assembly Floor (Ayes 53, Noes 7)

Assembly Appropriations Committee (Ayes 11, Noes 4)

Assembly Privacy and Consumer Protection Committee (Ayes 8, Noes 3)

**************

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of June 21, 2024]. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 3048

Author:(Lowenthal)

As Amended Ver:April 10, 2024

Majority vote

SUMMARY

Requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information.

Major Provisions

1. Prohibits a business from developing or maintaining a browser that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal be relatively easy for consumers to locate and enable.
3. Defines "browser" to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
4. Allows the California Privacy Protection Agency (Privacy Agency) to adopt regulations to implement and administer this legislation, including updating the definitions of "browser" and "device" to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

COMMENTS

For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only is our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed "surveillance capitalism" by social psychologist, Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the "normal" economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

Some may consider sharing their private information, including websites they visit, purchases, employment history, menstrual cycles, name, pictures, locations and movements, social media posts and reactions, and other seemingly innocuous information a reasonable price to pay for freely accessing the internet. However, not protecting that personal information can have real world consequences. As an example, dating app, Grindr, was fined 10 percent of its global annual revenue by the Norwegian Data Protection Authority in 2021 for sharing deeply personal information with advertisers, including location, sexual orientation and mental health details.^[3] This was not the first time Grindr had failed to protect their users' private information. Several years earlier, it was revealed that the company had shared HIV status and the location data from their users with two companies who were contracted to optimize the Grindr platform.^[4]

As noted above, the slow erosion of privacy, through the collection of relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor, Danielle Citron, warned in an interview with The Guardian in 2022, "We don't viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us."^[5]

What is an opt out preference signal? An opt-out preference signal, such as Global Privacy Controls (GPC), are a signal that is sent by a third-party platform on behalf of the consumer that communicates the consumer’'s choice to opt out of the sale and sharing of their personal information. Essentially, these signals are a way for users to communicate privacy preferences to a host of websites by using a specific search engine or browser plug-in rather than having to manually indicate the user's preferences on each website the user visits. Upon receiving this signal, websites cannot sell or share the consumer's personal information absent some affirmative action from the consumer granting permission to the respective website.

This bill, sponsored by the California Privacy Protection Agency, is intended to make it easier for consumers to limit the amount of personal information being collected every time they search for anything on the internet. In his letter of support, the executive director of the Privacy Agency, Ashkan Soltani, states, "Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business."

According to the author, in order to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, currently consumers must either use one of the few browsers that support an opt-out preference signal or take additional steps to locate and download a third-party browser plugin that adds support for such signals. As of the writing of this analysis, only Mozilla Firefox, DuckDuckGo, and Brave offer support for opt-out preference signals, which, together, make up less than 10% of the overall global desktop browser market share.

The operators of the world's largest internet browsers, most notably, Alphabet who owns Chrome, Apple that runs Safari, and Microsoft that operates Edge, have declined to adopt an opt-out preference signal to allow users of their browser to indicate they do not want their personal information sold or shared by any URL they visit while using the browser. These companies make up over 90% of the desktop browser market and also rely on advertising business models for their revenue, perhaps making it unlikely that they will voluntarily create an opt-out signal on their browsers. Because of this reality, the purpose this bill is to require all businesses with internet browsers used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. [This bill] makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

Oakland Privacy, writing in support of the bill, explains:

The current version of the CPRA contains an overly complicated set of alternative options that, while they apparently seemed desirable during the drafting phase, have not made opting out easy or simple for users. Anyone browsing the Internet nowadays is aware of the endless series of opt-out windows presented in varying styles, formats and places by virtually every website they visit. It is a rare internet user who does not mumble in exasperation that they wish they could just check it once and have it apply to all websites.

Arguments in Opposition

A coalition of opponents, including TechNet and the California Chamber of Commerce argue:

[This bill] will upend the balanced approach taken by voters, removing any such flexibility in the law. Yet it does not account for any of the myriad issues raised by mandating global privacy controls. For example, it does not permit consumers to reverse their decision and opt-back in if they so choose, both as a general matter and for specific use cases for specific businesses as well. Nor does it provide any clarity on how businesses can provide consumers who have previously indicated they wish to opt out via the signal with the opportunity to consent to the sale and sharing of their PI or the use and disclosure of their sensitive PI with that business, specifically.

FISCAL COMMENTS

According to the Appropriations Committee analysis:

Minor and absorbable costs to the California Privacy Protection Agency to issue regulations and enforce the opt-out preference signal requirement.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 8-3-0

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

NO: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-4-0

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

NO: Sanchez, Dixon, Jim Patterson, Ta

UPDATED

VERSION: April 10, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0002801

1. Preston, Alex. "The death of privacy." The Guardian (Aug. 3, 2014) available at https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. "You Are the Object of a Secret Extraction Operation." The New York Times (Nov. 12, 2021) available at https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Hern, Alex. "Grindr fined £8.6m in Norway over sharing personal information," The Guardian (Jan. 26, 2021) available at https://www.theguardian.com/technology/2021/jan/26/grindr-fined-norway-sharing-personal-information. ↑

4. "Grindr shared information about users' HIV status with third parties." The Guardian (Apr. 3, 2018) available at https://www.theguardian.com/technology/2018/apr/03/grindr-shared-information-about-users-hiv-status-with-third-parties. ↑

5. Clarke, Laurie. "Interview - Law professor Danielle Citron: 'Privacy is essential to human flourishing,'" The Guardian (Oct. 2, 2022) available at https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

Date of Hearing: April 24, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 3048

Author:(Lowenthal) – As Amended Ver:April 10, 2024

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires internet browsers to include an opt-out preference signal that allows a consumer to automatically exercise their right to opt-out of the selling and sharing of the consumer’s personal information.

FISCAL EFFECT:

Minor and absorbable costs to the California Privacy Protection Agency to issue regulations and enforce the opt-out preference signal requirement.

COMMENTS:

1. Purpose. According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

1. Background. With some exemptions, the California Consumer Privacy Act allows a consumer the right to know what personal information a business has collected about them and to opt out of the sale of their personal information. A consumer can opt out of the sale of their information by using an internet browser that supports an opt-out preference signal or by downloading a third-party browser plug-in. An opt-out preference signal is a signal sent by a third-party platform (like an internet browser or browser plug-in) that tells a website accessed by a user that the user chooses to opt out of the sale and sharing of their personal information. Upon receiving a user’s opt-out privacy signal, a website may not sell or share the user’s personal information, unless the consumer affirmatively grants the website permission to do so.

Currently, most major internet browsers – like Chrome, Safari, and Edge – do not support an opt-out preference signal. While there are a few browsers that support opt-out preference signals and a user may download a plug-in that fulfills the opt-out function in most major browsers, these methods put the onus on individual users to proactively opt out and protect their personal data. This bill instead requires each business with an internet browser used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit. This places the onus for facilitating a user’s ability to opt-out of sale of their information on the companies that operate the browsers – companies that generally also rely on advertising business models that generate profits from the sale of users’ personal information.

1. Related Legislation. AB 1824 (Valencia) requires a business that acquires the personal data of consumers through the acquisition of another business to honor the previous decisions of those consumers regarding the sale or sharing of their personal information. AB 1824 is pending hearing in this committee.

AB 1949 (Wicks) prohibits a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer’s parent or guardian if under 13, affirmatively authorizes the collection. AB 1949 is pending hearing in this committee.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 2, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 3048 (

Author:Lowenthal) – As Introduced Ver:February 16, 2024

AS PROPOSED TO BE AMENDED

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SYNOPSIS

Some people consider sharing their personal information, including the websites they visit, purchases they make, employment history, menstrual cycles, name, phone number, address, pictures, locations and movements, social media posts and reactions, and other seemingly innocuous information when taken individually, a reasonable price to pay for freely accessing the internet. However, not protecting that personal information can have real world consequences when it comes to searching for a job, purchasing a house, obtaining credit, opening a bank account, interacting with law enforcement, or trying to escape a dangerous and violent intimate partner.

As a way of giving Californians more power over how and when their personal information is collected, used, shared, and sold, the California Consumer Privacy Act (CCPA) grants us the right to direct a business to not sell or share our personal information at any time. However, despite the rights enshrined in the law, exercising those rights remains challenging, even for the most conscientious individuals.

This bill, sponsored by the California Privacy Protection Agency (Privacy Agency), endeavors to make it significantly easier for consumers to opt out of the sharing or sale of their personal information by requiring internet browsers to provide an opt-out preference signal that they can use to signal all of the businesses they interact with online that they are exercising their rights under the CCPA by prohibiting the businesses from sharing their personal information.

As Oakland Privacy notes in their support of this bill, “A right that is difficult to exercise becomes a conditional right: i.e. one that is only available if you are determined enough and computer-savvy enough to be able to utilize it. But the intention of the California Privacy Rights Act was not a conditional right to control the sale and sharing of your personal information. It was intended, and sold to voters, as an absolute right.”

Along with the Privacy Agency and Oakland Privacy, this bill is supported by Secure Justice and the Electronic Frontier Foundation (with the committee amendments). It is opposed by a coalition of business groups, including the Association of National Advertisers, California Chamber of Commerce, California Land Title Association, and California Retailers Association.

SUMMARY: Requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information. Specifically, this bill:

1. Prohibits a business from developing or maintaining a browser that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal be relatively easy for consumers to locate and enable.
3. Defines “browser” to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
4. Allows the California Privacy Protection Agency (Privacy Agency) to adopt regulations to implement and administer this legislation, including updating the definitions of “browser” and “device” to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these is the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
3. Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
4. Prohibits a business from selling or sharing the personal information of a child that is 16 years of age or younger, if the business has actual knowledge of the child’s age, unless the child, or the child’s parent or guardian in the case of children less than 13 years old has affirmatively authorized the sharing of selling of the personal information. (Civ. Code § 1798.120(c).)
5. Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Sale of the personal information of a consumer below the age of 16 is barred unless the minor opts-in to its sale.) (Civ. Code § 1798.12.)
   5. The right to direct a business that collects sensitive personal information about the consumer to limit its use of that information to specified necessary uses. (Civ. Code § 1798.121.)
   6. The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
6. Requires a business to provide clear and conspicuous links on its homepage allowing consumers to opt-out of the sale or sharing of their personal information and use or disclosure of their sensitive personal information. (Civ. Code § 1798.135(a).)
7. Allows a business to not comply with the requirement to provide opt-out links if the business allows consumers to opt-out of the sale, sharing, and use of their information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism based on the technical specifications set forth in the Privacy Agency’s regulations. (Civ. Code § 1798.135(b).)
8. Establishes the Privacy Agency, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
9. Requires the Privacy Agency to issue regulations that:
   1. Define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumer’s intent to opt-out of the sale or sharing of the consumer’s personal information and to limit the use or disclosure of the consumer’s sensitive personal information.
   2. Establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age.
10. Defines the following terms under the CCPA:
    1. “Business” means a for-profit entity that collects consumers’ personal information, does business in California, and meets one or more of the following criteria:
       1. It had gross annual revenue of over $25 million in the previous calendar year.
       2. It buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices annually.
       3. It derives 50% or more of its annual revenue from selling California residents’ personal information. (Civ. Code § 1798.140(d).)
    2. “Consumer” means a natural person who is a California resident. (Civ. Code § 1798.140(i).)
    3. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
       1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
       2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
       3. Biometric information.
       4. Internet activity information, including browsing history and search history.
       5. Geolocation data.
       6. Audio, electronic, visual, thermal, olfactory, or similar information.
       7. Professional or employment-related information. (Civ. Code § 1798.140(v).)
    4. “Sensitive personal information” means personal information that reveals a person’s:
       1. Social security, driver’s license, state identification card, or passport number.
       2. Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials.
       3. Precise geolocation.
       4. Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
       5. Email, mail and text messages.
       6. Genetic data.
       7. Information collected and analyzed relating to health.
       8. Information concerning sex life or sexual orientation. (Civ. Code § 1798.140(ae).)

FISCAL EFFECT: As currently in print, this bill is keyed fiscal.

COMMENTS:

1) Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only is our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed “surveillance capitalism” by social psychologist, Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the “normal” economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

Some may consider sharing their private information, including websites they visit, purchases, employment history, menstrual cycles, name, pictures, locations and movements, social media posts and reactions, and other seemingly innocuous information a reasonable price to pay for freely accessing the internet. However, not protecting that personal information can have real world consequences. As an example, dating app, Grindr, was fined 10 percent of its global annual revenue by the Norwegian Data Protection Authority in 2021 for sharing deeply personal information with advertisers, including location, sexual orientation and mental health details.^[3] This was not the first time Grindr had failed to protect their users’ private information. Several years earlier, it was revealed that the company had shared HIV status and the location data from their users with two companies who were contracted to optimize the Grindr platform.^[4]

As noted above, the slow erosion of privacy, through the collection of relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor, Danielle Citron, warned in an interview with The Guardian in 2022, “We don’t viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us.”^[5]

Catherine Powell pointed out in 2023 in a blog post for the Council on Foreign Affairs:

If you’ve engaged with any form of technology recently—whether through a smartphone, social media, a fitness tracker, even a seemingly innocuous game like Candy Crush—you have accumulated a substantial amount of intimate privacy data. Intimate data ranges from your location, to when you fall asleep, to even more closely guarded information like your menstrual cycle or sexual partners. And every day, this data is scraped, bought, and sold by data brokers to third parties. Beyond violating our privacy, this repurposing of our personal data undermines our security.^[6]

2) Purpose of this bill. This bill, sponsored by the Privacy Agency, is intended to make it easier for consumers to limit the amount of personal information being collected every time they search for anything on the internet. In his letter of support, the executive director of the Privacy Agency, Ashkan Soltani, states, “Opt-out preference signals such as the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them to send an opt-out request to every site with which they interact online, without having to make separate requests at each business.”

According to the author, in order to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, currently consumers must either use one of the few browsers that support an opt-out preference signal or take additional steps to locate and download a third-party browser plugin that adds support for such signals. As of the writing of this analysis, only Mozilla Firefox, DuckDuckGo, and Brave offer support for opt-out preference signals, which, together, make up less than 10% of the overall global desktop browser market share.

The operators of the world’s largest internet browsers, most notably, Alphabet who owns Chrome, Apple that runs Safari, and Microsoft that operates Edge, have declined to adopt an opt-out preference signal to allow users of their browser to indicate they do not want their personal information sold or shared by any URL they visit while using the browser. These companies make up over 90% of the desktop browser market and also rely on advertising business models for their revenue, perhaps making it unlikely that they will voluntarily create an opt-out signal on their browsers. Because of this reality, the purpose this bill is to require all businesses with internet browsers used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit.

3) Author’s statement. According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, but many of the top web browsers do not offer such signals. AB 3048 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

4) What is an opt-out preference signal? An opt-out preference signal, such as Global Privacy Controls (GPC), are a signal that is sent by a third-party platform on behalf of the consumer that communicates the consumer’s choice to opt out of the sale and sharing of their personal information. Essentially, these signals are a way for users to communicate privacy preferences to a host of websites by using a specific search engine or browser plug-in rather than having to manually indicate the user’s preferences on each website the user visits. Upon receiving this signal, websites cannot sell or share the consumer’s personal information absent some affirmative action from the consumer granting permission to the respective website.

5) The California Consumer Privacy Act and the California Privacy Rights Act (CPRA). In 2018, the Legislature enacted the CCPA (AB 375 (Chau, Chap. 55, Stats. 2018)), which gives consumers certain rights regarding their personal information, such as the right to: (1) know what personal information about them is collected and sold; (2) request the categories and specific pieces of personal information the business collects about them; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has the most comprehensive laws in the country when it comes to protecting consumers’ rights to privacy.

In addition, Proposition 24 created the Privacy Agency in California, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA and the CPRA. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.

To protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature only if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy.^[7]

6) Analysis. As discussed previously, the amount of personal, intimate information that is being collected and compiled into dossiers online is not necessarily harmless nor does it have to be the price users pay to be able navigate the internet. California has been on the forefront of developing robust privacy protection laws, especially the CCPA. However, over the last year or two, policymakers have been dealing with the fact that despite the rights enumerated in the CCPA, exercising those rights remains nearly impossible. Currently, the burden of exercising privacy rights is placed completely on individuals, requiring them to seek out each company that has collected their data and figure out how to request that they delete it or stop collecting it.

The CPRA contemplated the need for an opt-out signal and requires the Privacy Agency to promulgate regulations defining the requirements and technical specifications for two opt-out signals, a general opt-out for consumers, and one that can be used to allow children and their parents to indicate that they are under 16 and therefore afforded extra protections [see EXISITNG LAW #9]. Unfortunately the CPRA was less clear about requiring businesses subject to privacy laws to adopt an opt-out signal or any other single tool that makes it easy for consumers to exercise their rights.

Oakland Privacy, writing in support of the bill, explains:

The current version of the CPRA contains an overly complicated set of alternative options that, while they apparently seemed desirable during the drafting phase, have not made opting out easy or simple for users. Anyone browsing the Internet nowadays is aware of the endless series of opt-out windows presented in varying styles, formats and places by virtually every website they visit. It is a rare internet user who does not mumble in exasperation that they wish they could just check it once and have it apply to all websites.

Instead of requiring a single method for allowing consumers to exercise their privacy rights, the CPRA required businesses to offer specific links on their websites that allow consumers to opt-out, unless they choose to honor the information provided by an opt-out preference signal [see EXISITNG LAW #7 and 8]. The author and supporters argue that the CPRA’s failure to require a standardized opt-out process has made it difficult to reach the law’s full intent, which is to further Californians’ right to protect their privacy.

The opponents of the bill, a coalition of businesses, argue that requiring an opt-out preference signal is contrary to the CPRA, which intentionally allows businesses to implement the most effective method for their business. They state, “[The bill] will upend the balanced approach taken by voters, removing any such flexibility in the law.” Arguably, however, while this bill requires browsers to include an easy to locate opt-out preference signal, it does not prohibit individual websites from continuing to offer individual links that allow consumers to opt-out. Having both of these options available allows those consumers who would like to exercise a universal opt-out to do so, while allowing others to be selective in terms of which companies they allow to sell, share, and use their personal information and sensitive personal information.

Aside from requiring browsers to adopt an opt-out preference signal, the opponents argue that the language in the bill is not clear. They write:

As drafted, it is unclear whether the business has to refrain from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal to other businesses that the consumer interacts with or the business that develops or maintains the browser has to somehow prevent the consumer from interacting with another business that fails to include a setting that allows them to send a signal to the other business.

As currently written, the bill states:

(a) (1) A business shall not develop or maintain a browser through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business.

The opposition makes a valid point. As written, the requirement on businesses could be misconstrued. Committee amendments are intended to eliminate this confusion.

The proponents of the CPRA clearly stated that the act was intended to give consumers the power to stop businesses from tracking them without their knowledge and permission.^[8] Overall, requiring browsers to offer opt-out preference signals would significantly increase consumers’ ability to avail themselves of this right by sending a signal to every website they interact with that they are exercising their right to opt-out of the sale and sharing of their personal information.

7) Proposed Committee amendments. In order to address the concerns raised by the opposition and the Electronic Frontier Foundation related to sections of the bill that were unclear, the Committee amendments do the following:

Amendment #1 clarifies the requirements being placed on businesses.

1798.136(a) (1) A business shall not develop or maintain a browser through which a consumer interacts with a business that does not include a setting that enables the consumers to send an opt-out preference signal to that other businesses that the consumer interacts with through the browser.

Amendment #2 recognizes the many different forms a browser may take. For example, on smaller devices it may not be “easy to locate and use” any settings. The change in the language allows for the differences in devices

1798.136 (a)(2) The setting required by paragraph (1) shall be reasonably easy to locate and enable use.

Amendment #3 is intended to narrow and clarify the definition of “browser.”

1798.136 (d) As used in this section, “browser” means an interactive software application that is primarily used by a consumer to for accessing internet websites and information on the internet.

8) Related legislation. Over the last 5 years numerous bills have attempted to modify the CCPA and many have been successful in furthering its goals. In this hearing, alone, three bills, including this one, propose modifications to the CCPA. Specifically:

AB 1824 (Valencia) requires, under the CCPA, that businesses that are acquiring the personal data of consumers through the acquisition of another business, honor the previous decisions of consumers who have not given permission for the business to sell or share their personal information.

AB 1949 (Wicks) proposes amending the CCPA to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer’s parent or guardian if under 13, affirmatively authorizes the collection.

REGISTERED SUPPORT / OPPOSITION:

Support

California Privacy Protection Agency
Oakland Privacy
Secure Justice

Support If Amended

Electronic Frontier Foundation

Opposition

American Association of Advertising Agencies (4A's)
Association of National Advertisers
California Chamber of Commerce
California Land Title Association
California Retailers Association
Civil Justice Association of California
Computer & Communications Industry Association
Insights Association
Internet Coalition
Los Angeles Area Chamber of Commerce
Technet

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Preston, Alex. “The death of privacy.” The Guardian (Aug. 3, 2014) available at https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. “You Are the Object of a Secret Extraction Operation.” The New York Times (Nov. 12, 2021) available at https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Hern, Alex. “Grindr fined £8.6m in Norway over sharing personal information,” The Guardian (Jan. 26, 2021) available at https://www.theguardian.com/technology/2021/jan/26/grindr-fined-norway-sharing-personal-information. ↑

4. “Grindr shared information about users' HIV status with third parties.” The Guardian (Apr. 3, 2018) available at https://www.theguardian.com/technology/2018/apr/03/grindr-shared-information-about-users-hiv-status-with-third-parties. ↑

5. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) available at https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

6. Powell, Catherine. “Data is the New Gold, But May Threaten Democracy and Dignity,” Council on Foreign Relations (Jan. 5, 2023) available at https://www.cfr.org/blog/data-new-gold-may-threaten-democracy-and-dignity-0. ↑

7. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74 ↑

8. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 70 ↑