The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would, beginning January 1, 2027, prohibit a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. The bill would require a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the opt-out preference signal. The bill would grant a business that develops or maintains a browser that includes this functionality immunity from liability for a violation of those provisions by a business that receives the opt-out preference signal. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would, beginning January 1, 2027, prohibit a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. The bill would require a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the opt-out preference signal. The bill would grant a business that develops or maintains a browser that includes this functionality immunity from liability for a violation of those provisions by a business that receives the opt-out preference signal. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would would, beginning January 1, 2027, prohibit a business from developing or maintaining a browser or browser engine, browser, as defined, that does not include a setting functionality configurable by a consumer that enables a consumer the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser or browser engine, browser, as prescribed. The bill would require a business that develops or maintains a browser or browser engine to make clear to a consumer in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply. and the intended effect of the opt-out preference signal. The bill would grant a business that develops or maintains a browser that includes this functionality, immunity from liability for a violation of those provisions by a business that receives the opt-out preference signal. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser or browser engine, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. or browser engine, as prescribed. The bill would require a business that develops or maintains a browser or browser engine to make clear to a consumer in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 566

Author:(Lowenthal)

As Amended Ver:September 5, 2025

Majority vote

SUMMARY

This bill requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt out of the selling and sharing of their personal information.

Senate Amendments

1. Deletes browser engines.
2. Deletes requirement that a business that develops and maintains a browser disclose the types of personal information to which the opt-out preference signal would apply.
3. Declares that a business that includes a functionality that enables the browser to send an opt-out preference signal is not liable for a violation of this title by a business that receives the signal.
4. Delays implementation until January 1, 2027.

COMMENTS

Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only has our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed "surveillance capitalism" by social psychologist Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the "normal" economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

The slow erosion of privacy, through the collection of what seem to be relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor Danielle Citron warned in an interview with The Guardian in 2022, "We don't viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us."^[3]

With the rapid growth in the development of Artificial Intelligence (AI) systems, particularly large-language models, people's personal information has become even more valuable as developers require ever-increasing amounts of data to train their foundation models. Going forward, AI development will continue to increase developers' hunger for training data, fueling an even greater race for data acquisition than we have already seen in past decades.^[4]

Challenges with California's privacy laws. In 1972, at the Legislature's urging, the people of California used the initiative process to add "privacy" to the list of "inalienable rights" in the state constitution.^[5] Proponents noted the initiative was specifically designed to preserve Californians' private lives and fundamental rights in the face of technological advances. They argued: "The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . ."^[6]

In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA)(AB 375 (Chau, Chap. 55, Stats. 2018)), which gave consumers certain rights regarding their personal information,^[7] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. Chief among these rights was the right of a consumer to limit a business's use of sensitive personal.^[8] With the passage of the CCPA and the CPRA, California, at the time, had the most comprehensive laws in the country when it came to protecting consumers' rights to privacy.

Since the passage of the CCPA, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to "opt in" to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[9] In the states that have come after California, privacy is the default. The CCPA, on the other hand, relies on consumers actively exercising their rights to "opt out" of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer often does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step. >

Arguments in Support

The California Privacy Protection Agency, sponsors of the bill, write in support:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them, in a single step, to send an opt-out request to every site with which they interact online. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020, and the CPPA's regulations, adopted in 2023, update the opt-out preference signal requirement.

[. . .]

The lack of signal uptake by browsers has created a burden for consumers. Today, to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, consumers must either find one of the few privacy-focused browsers or take extra steps to locate and download a browser plugin created by third-party developers that adds support for such signals, which can introduce additional privacy and security concerns. Further, consumers accessing the internet through an Apple mobile device have no access to these signals.

Arguments in Opposition

In opposition to the bill, the California Chamber of Commerce, along with a number of other business organizations, argues:

First and foremost, it is important to know that voters already allowed for businesses to incorporate and recognize opt-out preference signals under the CCPA when they passed Proposition 24. However, in contrast to AB 566, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; instead, it provides businesses the option and required the California Privacy Protection Agency. . . to adopt regulations around that voluntary use.

FISCAL COMMENTS

Minor and absorbable costs to the California Privacy Protection Agency (Privacy Agency) to issue regulations and enforce the opt-out preference signal requirement. The Privacy Agency anticipates initial costs will be absorbable but its Legal Division may seek additional resources if recurring rulemaking is necessary in the future.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-6

YES: Berman, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wilson

ABS, ABST OR NV: Bauer-Kahan, Dixon, DeMaio, Macedo, Patterson, Petrie-Norris

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

ASSEMBLY FLOOR: 53-1-25

YES: Addis, Aguiar-Curry, Ahrens, Alvarez, Arambula, Ávila Farías, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Pacheco, Pellerin, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Ward, Wicks, Wilson, Zbur, Rivas

NO: DeMaio

ABS, ABST OR NV: Alanis, Bains, Castillo, Chen, Davies, Dixon, Ellis, Flora, Gallagher, Jeff Gonzalez, Hadwick, Hoover, Irwin, Lackey, Macedo, Ortega, Papan, Patel, Patterson, Petrie-Norris, Michelle Rodriguez, Sanchez, Ta, Tangipa, Wallis

UPDATED

VERSION: September 5, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0001997

1. Preston, Alex. "The death of privacy." The Guardian (Aug. 3, 2014) https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. "You Are the Object of a Secret Extraction Operation." The New York Times (Nov. 12, 2021) https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Clarke, Laurie. "Interview - Law professor Danielle Citron: 'Privacy is essential to human flourishing,'" The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

4. King, Jennifer and Meinhardt, Caroline. Rethinking Privacy in the AI Era. Human-Cantered Artificial Intelligence at Stanford University (Feb. 2024) https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf. ↑

5. California Proposition 11 (1972), "Constitutional Right to Privacy Amendment." ↑

6. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

7. Civ. Code Section 1798.140(v). See EXISTING LAW no. 10(a) for definition. ↑

8. Civ. Code Section 1798.140(ae). See EXISTING LAW no. 10(b) for definition. ↑

9. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf

   . ↑

 THIRD READING  

Bill No: AB 566

Author: Lowenthal (D), et al.

Amended: 9/5/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/1/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello, Valladares

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 53-1, 6/5/25 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SOURCE: California Privacy Protection Agency

DIGEST:

This bill requires browsers to include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to a business with which a consumer interacts through the browser.

Senate Floor amendments of 9/5/25 delay the effective date and narrow the scope of the bill.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information. (Civil (Civ.) Code § 1798.100 et seq.)
2. Provides consumers the right, at any time, to direct a business that sells or shares the consumer’s personal information to third parties not to sell or share that information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)

This bill:

1. Establishes the California Opt Me Out Act.
2. Prohibits a business from developing or maintaining a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to a business with which the consumer interacts through the browser. This required functionality must be easy for a reasonable person to locate and configure.
3. Requires a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the signal.
4. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
5. Defines the relevant terms:
   1. “Browser” means an interactive software application that is used by consumers to locate, access, and navigate internet websites.
   2. “Opt-out preference signal” means a signal that complies with this title and that communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information.
6. Findings include declarations that this law furthers the purposes and intent of the CPRA.
7. Becomes operative on January 1, 2027.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA. Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and configure. This bill is sponsored by the California Privacy Protection Agency. It is supported by a number of privacy and consumer advocacy groups as well as technology companies, including Mozilla and the Center for Digital Democracy and Consumer Reports. A number of industry associations are opposed, including the California Apartment Association.

Comments

Despite the right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice (DOJ) included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, updated the opt-out preference signal requirement. The author argues that now that California businesses receiving opt-out preference signals are required to honor them, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and configure. This bill authorizes the PPA to adopt regulations.

According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

A substantially similar bill was passed by the Legislature last year, AB 3048 (Lowenthal, 2024), but it was vetoed by Governor Newsom, who stated:

This bill would require internet browsers and mobile operating systems to include a setting that California consumers can use to signal to businesses with which they interact that they wish to, first, opt out of the sale or sharing of their personal information, and second, limit use of their sensitive personal information.

I share the author's desire to enhance consumer privacy. Last year, I signed SB 362 (Becker), which requires the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information.

I am concerned, however, about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

In response to this veto message, this bill does not place obligations on operating systems, but rather limits its focus to browsers.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

Senate Rule 28.8

SUPPORT: (Verified 9/9/25)

California Privacy Protection Agency (source)
Access Humboldt

Brave Software

California Initiative for Technology and Democracy

Center for Democracy and Technology

Center for Digital Democracy

Center for Economic Justice

Common Sense Media

Concept Art Association

Consumer Action

Consumer Federation of America

Consumer Federation of California

Consumer Reports

Consumer Watchdog

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center

Los Angeles County Democratic Party

Mothers Against Media Addiction

Mozilla

Oakland Privacy

Omidyar

Privacy Rights Clearinghouse

Santa Monica Democratic Club

Secure Justice

Tech Oversight California

OPPOSITION: (Verified 9/9/25)

Association of National Advertisers

California Apartment Association
California Chamber of Commerce
California Retailers Association
Chamber of Progress

Computer and Communications Industry Association
Insights Association

Silicon Valley Leadership Group
Software Information Industry Association
Technet

ARGUMENTS IN SUPPORT: The PPA writes:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights at scale to opt-out of sale under the [CCPA] by enabling them, in a single step, to send an opt-out request to every site they interact with online. The CCPA currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. [DOJ] included this in their CCPA regulations, adopted in 2020 and the CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

However, only a handful of browsers currently offer native support for opt-out preference signals. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share—have declined to offer these signals.

In addition, while major browsers including Google have rebuffed calls to offer opt-out preference signals to support consumers, Google has simultaneously introduced new practices in the last few months that further erode Californians’ privacy. In February of 2025, Google updated its policies to allow its ad partners to use digital fingerprinting technologies to identify users and collect information about them. Fingerprinting allows businesses to collect information about a device’s hardware or software which can easily be combined with other data to uniquely identify a user. As critics, including the UK’s data protection authority have pointed out, this technology largely operates unknown to the user and outside of their control. One of the best ways for a consumer to limit the privacy harms of digital fingerprinting is for consumers to be able to send opt-out preference signals.

ARGUMENTS IN OPPOSITION: The Association of National Advertisers states:

California consumers already have access to opt-out preference signals in the marketplace. Consumers can use browsers that enable such signals or download extensions or other technologies that allow them to set such signals. AB 566 is therefore unnecessary. In addition, the bill is ambiguous, would harm competition, would delegate broad authority to the [CCPA] to issue regulations for standards that should instead be set by the legislature, and would continue to impose impracticable obligations on mobile operating system (“OS”) developers. The Governor vetoed a similar proposal under AB 3048 just last year, reasoning that imposing a technical mandate on mobile operating systems could impact the ongoing usability of mobile devices. In vetoing the bill, the Governor expressed concern with “placing a mandate on operating system (OS) developers at this time” and stated that “. . . it’s best if design questions are first addressed by developers, rather than by regulators.”

ASSEMBLY FLOOR: 53-1, 6/5/25

AYES: Addis, Aguiar-Curry, Ahrens, Alvarez, Arambula, Ávila Farías, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Pacheco, Pellerin, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Ward, Wicks, Wilson, Zbur, Rivas

NOES: DeMaio

NO VOTE RECORDED: Alanis, Bains, Castillo, Chen, Davies, Dixon, Ellis, Flora, Gallagher, Jeff Gonzalez, Hadwick, Hoover, Irwin, Lackey, Macedo, Ortega, Papan, Patel, Patterson, Petrie-Norris, Michelle Rodriguez, Sanchez, Ta, Tangipa, Wallis

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/9/25 17:21:03

**** END ****

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of July 14, 2025]. ↑

 THIRD READING  

Bill No: AB 566

Author: Lowenthal (D)

Amended: 6/2/25 in Assembly

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/1/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello, Valladares

SENATE APPROPRIATIONS COMMITTEE: Senate Rule 28.8

ASSEMBLY FLOOR: 53-1, 6/5/25 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SOURCE: California Privacy Protection Agency

DIGEST:

This bill requires browsers and browser engines to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts through the browser.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act (CCPA), which grants consumers certain rights with regard to their personal information. (Civil (Civ.) Code § 1798.100 et seq.)
2. Provides consumers the right, at any time, to direct a business that sells or shares the consumer’s personal information to third parties not to sell or share that information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
4. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
5. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)

This bill:

1. Establishes the California Opt Me Out Act.
2. Prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and configure.
3. Requires a business that develops or maintains a browser or browser engine to make clear to a consumer in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply.
4. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
5. Defines the relevant terms:
   1. “Browser” means an interactive software application that is used by consumers to locate, access, and navigate internet websites.
   2. “Browser engine” means the software component of a web browser or web-enabled application that interprets and renders web content, including HTML, CSS, and JavaScript, transforming code into interactive visual output on a consumer’s device, including, but not limited to, Blink, Gecko, and WebKit.
   3. “Opt-out preference signal” means a signal that complies with this title and that communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information.
6. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA. Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and configure. This bill is sponsored by the California Privacy Protection Agency. It is supported by a number of privacy and consumer advocacy groups as well as technology companies, including Mozilla and the Center for Digital Democracy and Consumer Reports. A number of industry associations are opposed, including the California Apartment Association.

Comments

Despite the right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice (DOJ) included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, updated the opt-out preference signal requirement. The author argues that now that California businesses receiving opt-out preference signals are required to honor them, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and configure. This bill authorizes the PPA to adopt regulations.

According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

A substantially similar bill was passed by the Legislature last year, AB 3048 (Lowenthal, 2024), but it was vetoed by Governor Newsom, who stated:

This bill would require internet browsers and mobile operating systems to include a setting that California consumers can use to signal to businesses with which they interact that they wish to, first, opt out of the sale or sharing of their personal information, and second, limit use of their sensitive personal information.

I share the author's desire to enhance consumer privacy. Last year, I signed SB 362 (Becker), which requires the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information.

I am concerned, however, about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

In response to this veto message, this bill does not place obligations on operating systems, but rather limits its focus to browsers and browser engines.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

Senate Rule 28.8

SUPPORT: (Verified 7/14/25)

California Privacy Protection Agency (sponsor)
Access Humboldt

Brave Software

California Initiative for Technology and Democracy

Center for Democracy and Technology

Center for Digital Democracy

Center for Economic Justice

Common Sense Media

Concept Art Association

Consumer Action

Consumer Federation of America

Consumer Federation of California

Consumer Reports

Consumer Watchdog

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center

Los Angeles County Democratic Party

Mothers Against Media Addiction

Mozilla

Oakland Privacy

Privacy Rights Clearinghouse

Santa Monica Democratic Club

Secure Justice

Tech Oversight California

OPPOSITION: (Verified 7/14/25)

Association of National Advertisers

California Apartment Association
California Chamber of Commerce
California Retailers Association
Chamber of Progress

Computer and Communications Industry Association
Insights Association

Silicon Valley Leadership Group
Software Information Industry Association
Technet

ARGUMENTS IN SUPPORT: The PPA writes:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights at scale to opt-out of sale under the [CCPA] by enabling them, in a single step, to send an opt-out request to every site they interact with online. The CCPA currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. [DOJ] included this in their CCPA regulations, adopted in 2020 and the CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

However, only a handful of browsers currently offer native support for opt-out preference signals. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share—have declined to offer these signals.

In addition, while major browsers including Google have rebuffed calls to offer opt-out preference signals to support consumers, Google has simultaneously introduced new practices in the last few months that further erode Californians’ privacy. In February of 2025, Google updated its policies to allow its ad partners to use digital fingerprinting technologies to identify users and collect information about them. Fingerprinting allows businesses to collect information about a device’s hardware or software which can easily be combined with other data to uniquely identify a user. As critics, including the UK’s data protection authority have pointed out, this technology largely operates unknown to the user and outside of their control. One of the best ways for a consumer to limit the privacy harms of digital fingerprinting is for consumers to be able to send opt-out preference signals.

ARGUMENTS IN OPPOSITION: The Association of National Advertisers states:

California consumers already have access to opt-out preference signals in the marketplace. Consumers can use browsers that enable such signals or download extensions or other technologies that allow them to set such signals. AB 566 is therefore unnecessary. In addition, the bill is ambiguous, would harm competition, would delegate broad authority to the [CCPA] to issue regulations for standards that should instead be set by the legislature, and would continue to impose impracticable obligations on mobile operating system (“OS”) developers. The Governor vetoed a similar proposal under AB 3048 just last year, reasoning that imposing a technical mandate on mobile operating systems could impact the ongoing usability of mobile devices. In vetoing the bill, the Governor expressed concern with “placing a mandate on operating system (OS) developers at this time” and stated that “. . . it’s best if design questions are first addressed by developers, rather than by regulators.”

ASSEMBLY FLOOR: 53-1, 6/5/25

AYES: Addis, Aguiar-Curry, Ahrens, Alvarez, Arambula, Ávila Farías, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Connolly, Elhawary, Fong, Gabriel, Garcia, Gipson, Mark González, Haney, Harabedian, Hart, Jackson, Kalra, Krell, Lee, Lowenthal, McKinnor, Muratsuchi, Nguyen, Pacheco, Pellerin, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Rogers, Blanca Rubio, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Valencia, Ward, Wicks, Wilson, Zbur, Rivas

NOES: DeMaio

NO VOTE RECORDED: Alanis, Bains, Castillo, Chen, Davies, Dixon, Ellis, Flora, Gallagher, Jeff Gonzalez, Hadwick, Hoover, Irwin, Lackey, Macedo, Ortega, Papan, Patel, Patterson, Petrie-Norris, Michelle Rodriguez, Sanchez, Ta, Tangipa, Wallis

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

7/15/25 16:21:41

**** END ****

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of July 14, 2025]. ↑

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2025-2026 Regular Session

Bill No: AB 566 (Author:Lowenthal)

Version: June 2, 2025

Hearing Date: July 1, 2025

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Consumer Privacy Act of 2018: opt-out preference signal

DIGEST

This bill requires browsers and browser engines to include a setting that enables a consumer to send an opt-out preference signal to a business with which a consumer interacts through the browser.

EXECUTIVE SUMMARY

The California Consumer Privacy Act (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the California Privacy Protection Agency (PPA). Relevant here, the CCPA provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers of their opt-out right.

This bill seeks to empower consumers to exercise this right more meaningfully in the many interactions they have with businesses online. It prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. The setting must be easy for a reasonable person to locate and configure. This bill is sponsored by the California Privacy Protection Agency. It is supported by a number of privacy and consumer advocacy groups as well as technology companies, including Mozilla and the Center for Digital Democracy and Consumer Reports. No timely opposition was received.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120.)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides a business shall not be required to comply with the requirement to place a clear and conspicuous link to opt out if the business allows consumers to opt out of the sale or sharing of their personal information and to limit the use of their sensitive personal information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism, based on technical specifications set forth in regulations. (Civ. Code § 1798.135.)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Establishes the California Opt Me Out Act.
2. Prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. This required setting must be easy for a reasonable person to locate and configure.
3. Requires a business that develops or maintains a browser or browser engine to make clear to a consumer in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply.
4. Authorizes the PPA to adopt regulations as necessary to implement and administer this law.
5. Defines the relevant terms:
   1. “Browser” means an interactive software application that is used by consumers to locate, access, and navigate internet websites.
   2. “Browser engine” means the software component of a web browser or web-enabled application that interprets and renders web content, including HTML, CSS, and JavaScript, transforming code into interactive visual output on a consumer’s device, including, but not limited to, Blink, Gecko, and WebKit.
   3. “Opt-out preference signal” means a signal that complies with this title and that communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information.
6. Includes findings and declarations that this law furthers the purposes and intent of the CPRA.

COMMENTS

1. California’s landmark privacy protection law

As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct.

The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells or shares personal information to third parties is required to notify consumers that this information may be sold or shared and that they have the right to opt out of such sales. (Civ. Code § 1798.120(b).)

1. Providing tools to effectuate consumer rights

Despite this right to opt out, many consumers are simply overwhelmed with meaningfully exercising this right given all the businesses that the consumer interacts with online. According to research by Consumer Reports:

The CCPA’s opt-out model is inherently flawed; it places substantial responsibility on consumers to identify the companies that collect and sell their information, and to submit requests to access it, delete it, or stop its sale. Even when companies are making a good-faith effort to comply, the process can quickly become unmanageable for consumers who want to opt out of data sale by hundreds if not thousands of different companies.^[1]

The report found that consumers struggled to locate the required links and were forced to navigate through confusing disclosures. The report offered up a number of policy recommendations, including that consumers should have access to browser privacy signals that allow them to opt out of all data sales in one step.

Previous attempts have been made to achieve this sort of mechanism, including when nearly all major browser vendors adopted “Do Not Track,” a technology that allowed consumers to transmit “Do Not Track” requests to businesses via their web browser. However, there was no legal requirement to honor these signals.

More recently Global Privacy Control entered the market. It is a browser setting that notifies websites of a consumer’s privacy preferences, such as not sharing or selling their personal information, with each website the consumer visits.

The CCPA requires businesses to honor opt-out preference signals as a request to opt-out of sale of their personal information. The California Department of Justice (DOJ) included this in their CCPA regulations, adopted in 2020. The PPA’s regulations, adopted in 2023, updated the opt-out preference signal requirement.

The author argues that now that California businesses receiving opt-out preference signals are required to honor them under the CCPA, there is a significant opportunity to expand consumer access by requiring browsers to offer similar preference signals to consumers. This bill provides that a business shall not develop or maintain a browser or browser engine that does not include a setting that enables a consumer to send an opt-out preference signal to a business with which the consumer interacts through the browser. It requires the setting to be easy for a reasonable person to locate and configure. The bill authorizes the PPA to adopt regulations.

According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

It should be noted that a substantially similar bill was passed by the Legislature last year, AB 3048 (Lowenthal, 2024). AB 3048 was vetoed by Governor Newsom, who stated in his message:

This bill would require internet browsers and mobile operating systems to include a setting that California consumers can use to signal to businesses with which they interact that they wish to, first, opt out of the sale or sharing of their personal information, and second, limit use of their sensitive personal information.

I share the author's desire to enhance consumer privacy. Last year, I signed SB 362 (Becker), which requires the California Privacy Protection Agency to establish an accessible deletion mechanism allowing consumers to request that data brokers delete all of their personal information.

I am concerned, however, about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

In response to this veto message, this bill does not place obligations on operating systems, but rather limits its focus to browsers and browser engines.

Relevant here, and cited by the Governor above, SB 362 (Becker, Ch. 709, Stats. 2023) established the Delete Act, which bolstered the data broker registry law by, in part, requiring more information to be reported and transferring much of the relevant duties from DOJ to the PPA. More importantly, it also expanded consumers’ deletion rights and requires the PPA to create an accessible deletion mechanism that allows a consumer, through a single request, to request that every data broker delete the personal information related to the consumer and held by the data broker, except as specified. To ensure consumers can meaningfully exercise their rights under the law given the hundreds of data brokers on the registry, the mechanism is required to support the ability of a consumer’s authorized agent to aid in the deletion request.

1. Stakeholder positions

This bill is sponsored by the PPA, which explains the need for the bill:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights at scale to opt-out of sale under the California Consumer Privacy Act (CCPA) by enabling them, in a single step, to send an opt-out request to every site they interact with online. The CCPA currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020 and the CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

However, only a handful of browsers currently offer native support for opt-out preference signals. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share—have declined to offer these signals.

In addition, while major browsers including Google have rebuffed calls to offer opt-out preference signals to support consumers, Google has simultaneously introduced new practices in the last few months that further erode Californians’ privacy. In February of 2025, Google updated its policies to allow its ad partners to use digital fingerprinting technologies to identify users and collect information about them. Fingerprinting allows businesses to collect information about a device’s hardware or software which can easily be combined with other data to uniquely identify a user. As critics, including the UK’s data protection authority have pointed out, this technology largely operates unknown to the user and outside of their control. One of the best ways for a consumer to limit the privacy harms of digital fingerprinting is for consumers to be able to send opt-out preference signals.

A coalition of tech companies and advocacy groups in support, including Brave Software and the Electronic Privacy Information Center, write:

Opt-out preference signals were a policy response to the suboptimal consumer rights formulation under the initial version of the CCPA, which required consumers to effectuate their opt-out requests individually with each business with which they interacted. That meant that consumers with a generalized preference not to allow the sharing or selling of their personal information would have had to contact hundreds, if not thousands, of businesses in order to satisfy that preference.

As Consumer Reports testing showed, the individual opt-out structure was intensely cumbersome for consumers – many consumers struggled to complete an opt-out request on just a single data broker’s website – an arrangement that depresses the usage of consumer rights under the law. Opt-out preference signals were intended to relieve this burden and make it easier for consumers to express their privacy preferences.

Subsequent to the passage of CPRA’s amendments to the CCPA that created the opt-out preference signal requirement (as well the enactment of several other state privacy laws that create similar requirements), we’ve seen numerous privacy-conscious browser vendors, such as Brave, DuckDuckGo, and Firefox support the concept of opt-out preference signals. Most commonly, such browsers do so by enabling usage of Global Privacy Control, a technical specification that has been interpreted by the California Privacy Protection Agency and California Attorney General to serve as a permissible opt-out preference signal under the CCPA. These browsers typically either enable the GPC signal to be sent by default or make it a setting the user can easily toggle on or off.

However, the largest browser vendors (Apple Safari, Google Chrome, and Microsoft Edge, which cumulatively enjoy more than 90% of the browser share in the United States) currently do not provide native support for opt-out preference signals. Today, if a user wants to send an opt-out preference signal on Chrome, Safari, or Edge, they need to download a third-party extension to do so, while a mobile platform user cannot configure their device to send an opt-out preference signal at all. As a result, millions of Californians, while technically enjoying the right to send such a signal, likely have no idea that this right even exists and have no easy way of acting on it even if they did. . . .

AB 566 will ensure that consumers have the ability to use their privacy rights by requiring that browser vendors and browser engines include an easy to locate and use setting that enables the consumer to send an opt-out preference signal. This bill’s approach will help reduce opt-out friction and make it easier for California residents to control their data, while also providing for flexibility by allowing the CPPA to adopt rules that will allow the law to keep pace with technology.

Writing in support, Oakland Privacy explains why existing law and options are inadequate:

California has come too far down this particular road to pursue any other avenue than robust opt-out protocols. User testing, from Consumer Reports among others, has documented that even motivated users find the current opt-out options to be repetitive, confusing and burdensome.

The operators of the world’s largest Internet browsers, most notably Alphabet (which runs Chrome) and Microsoft (which operates Edge), have declined to adopt an opt-out preference signal to allow users of their browser to indicate they don’t want their personal information sold or shared by any URL they visit while using the browser. Chrome, in particular, has stubbornly insisted on incorporating an opt-out preference signal only as a browser extension, an add-on piece of software users have to locate and install themselves. Apple, despite its marketing as a more privacy-friendly tech giant, has also declined a straightforward installation of a preference signal, preferring to instead develop proprietary cookie delimiters for Safari, their browser for iOs. Some smaller browsers like Firefox, Brave and Opera have, or are in the process of, implementing a browser preference signal, but they are used by much smaller segments of the general Internet user base.

1. Furthering the purpose and intent of the CPRA

Section 25 of the CPRA requires any amendments thereto to be “consistent with and further the purpose and intent of this act as set forth in Section 3.” Section 3 declares that “it is the purpose and intent of the people of the State of California to further protect consumers’ rights, including the constitutional right of privacy.” It then lays out a series of guiding principles. These include various consumer rights such as:

• consumers should know who is collecting their personal information;
• consumers should have control over how their personal information is used; and
• consumers should benefit from businesses’ use of their personal information.

Section 3 also includes a series of responsibilities that businesses should have. These include:

• businesses should specifically and clearly inform consumers about how they use personal information; and
• businesses should only collect consumers’ personal information for specific, explicit, and legitimate disclosed purposes.

Section 3 also lays out various guiding principles about how the law should be implemented.

The bill ensures a pathway for consumers to more effectively exercise their rights under the CCPA. Therefore, as it explicitly states, this bill “furthers the purposes and intent of the California Privacy Rights Act of 2020.”

SUPPORT

California Privacy Protection Agency (sponsor)
Access Humboldt

Brave Software

Center for Democracy and Technology

Center for Digital Democracy

Center for Economic Justice

Common Sense Media

Concept Art Association

Consumer Action

Consumer Federation of America

Consumer Federation of California

Consumer Reports

Consumer Watchdog

Digital Content Next

Electronic Frontier Foundation

Electronic Privacy Information Center (EPIC)

Los Angeles County Democratic Party

Mothers Against Media Addiction

Mozilla

Oakland Privacy

Privacy Rights Clearinghouse

Santa Monica Democratic Club

Secure Justice

Tech Oversight California

OPPOSITION

None known

RELATED LEGISLATION

Pending Legislation:

SB 361 (Becker, 2025) expands the disclosures that data brokers must make when registering with California’s Data Broker Registry. SB 361 is currently in the Assembly Appropriations Committee.

AB 656 (Schiavo, 2025) requires large social media platforms to provide users with a clear and accessible mechanism for deleting their accounts and associated personal information. AB 656 is currently in this Committee and is set to be heard the same day as this bill.

Prior Legislation:

AB 3048 (Lowenthal, 2024) See Comment 2.

SB 362 (Becker, Ch. 709, Stats. 2023) See Comment 2.

PRIOR VOTES:

Assembly Floor (Ayes 53, Noes 1)

Assembly Appropriations Committee (Ayes 11, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 9, Noes 0)

**************

1. Maureen Mahoney, California Consumer Privacy Act: Are Consumers’ Digital Rights Protected? (October 1, 2020) Consumer Reports, https://advocacy.consumerreports.org/wp-content/uploads/2020/09/CR_CCPA-Are-Consumers-Digital-Rights-Protected_092020_vf.pdf [as of June 21, 2025]. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 566

Author:(Lowenthal)

As Amended Ver:June 2, 2025

Majority vote

SUMMARY

This bill requires that internet browsers and browser engines include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt out of the selling and sharing of their personal information.

Major Provisions

1. Prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal on a browser be easy for a reasonable person to locate and configure.
3. Requires that the business that develops and maintains the browser or browser engine make clear to consumers in its public disclosures how the opt-out preference signal works and the type of personal information to which the signal would apply.
4. Defines "browser" to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
5. Defines "browser engine" to mean the software component of a web browser or web-enabled applications that interprets and renders web content into an interactive visual output on a consumer's device.
6. Defines "opt-out preference signal" to mean a signal that complies with the requirements of this legislation and communicates the consumer's choice to opt out of the sale and sharing of the consumer's personal information.
7. Authorizes the California Privacy Protection Agency to use its regulatory process to implement the provisions of the bill.

COMMENTS

Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only has our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed "surveillance capitalism" by social psychologist Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the “normal” economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

The slow erosion of privacy, through the collection of what seem to be relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor Danielle Citron warned in an interview with The Guardian in 2022, "We don't viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us."^[3]

With the rapid growth in the development of Artificial Intelligence (AI) systems, particularly large-language models, people’s personal information has become even more valuable as developers require ever-increasing amounts of data to train their foundation models. Going forward, AI development will continue to increase developers' hunger for training data, fueling an even greater race for data acquisition than we have already seen in past decades.^[4]

Challenges with California's privacy laws. In 1972, at the Legislature's urging, the people of California used the initiative process to add "privacy" to the list of "inalienable rights" in the state constitution.^[5] Proponents noted the initiative was specifically designed to preserve Californians' private lives and fundamental rights in the face of technological advances. They argued: "The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . ."^[6]

In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA)(AB 375 (Chau, Chap. 55, Stats. 2018)), which gave consumers certain rights regarding their personal information,^[7] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. Chief among these rights was the right of a consumer to limit a business's use of sensitive personal.^[8] With the passage of the CCPA and the CPRA, California, at the time, had the most comprehensive laws in the country when it came to protecting consumers' rights to privacy.

Since the passage of the CCPA, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to

"opt in" to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[9] In the states that have come after California, privacy is the default. The CCPA, on the other hand, relies on consumers actively exercising their rights to "opt out" of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer often does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

The California Privacy Protection Agency, sponsors of the bill, write in support:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them, in a single step, to send an opt-out request to every site with which they interact online. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020, and the CPPA's regulations, adopted in 2023, update the opt-out preference signal requirement.

[. . .]

The lack of signal uptake by browsers has created a burden for consumers. Today, to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, consumers must either find one of the few privacy-focused browsers or take extra steps to locate and download a browser plugin created by third-party developers that adds support for such signals, which can introduce additional privacy and security concerns. Further, consumers accessing the internet through an Apple mobile device have no access to these signals.

Arguments in Opposition

In opposition to the bill, the California Chamber of Commerce, along with a number of other business organizations, argues:

First and foremost, it is important to know that voters already allowed for businesses to incorporate and recognize opt-out preference signals under the CCPA when they passed Proposition 24. However, in contrast to AB 566, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; instead, it provides businesses the option and required the California Privacy Protection Agency. . . to adopt regulations around that voluntary use.

FISCAL COMMENTS

Minor and absorbable costs to the California Privacy Protection Agency (Privacy Agency) to issue regulations and enforce the opt-out preference signal requirement. The Privacy Agency anticipates initial costs will be absorbable but its Legal Division may seek additional resources if recurring rulemaking is necessary in the future.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-6

YES: Berman, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wilson

ABS, ABST OR NV: Bauer-Kahan, Dixon, DeMaio, Macedo, Patterson, Petrie-Norris

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

UPDATED

VERSION: June 2, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0000958

1. Preston, Alex. “The death of privacy.” The Guardian (Aug. 3, 2014) https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. “You Are the Object of a Secret Extraction Operation.” The New York Times (Nov. 12, 2021) https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

4. King, Jennifer and Meinhardt, Caroline. Rethinking Privacy in the AI Era. Human-Cantered Artificial Intelligence at Stanford University (Feb. 2024) https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf. ↑

5. California Proposition 11 (1972), “Constitutional Right to Privacy Amendment.” ↑

6. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

7. Civ. Code Section 1798.140(v). See EXISTING LAW #10(a) for definition. ↑

8. Civ. Code Section 1798.140(ae). See EXISTING LAW #10(b) for definition. ↑

9. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf

   . ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 566

Author:(Lowenthal)

As Amended Ver:June 2, 2025

Majority vote

SUMMARY

This bill requires that internet browsers and browser engines include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt out of the selling and sharing of their personal information.

Major Provisions

1. Prohibits a business from developing or maintaining a browser or browser engine that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal on a browser be easy for a reasonable person to locate and configure.
3. Requires that the business that develops and maintains the browser or browser engine make clear to consumers in its public disclosures how the opt-out preference signal works and the type of personal information to which the signal would apply.
4. Defines "browser" to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
5. Defines "browser engine" to mean the software component of a web browser or web-enabled applications that interprets and renders web content into an interactive visual output on a consumer's device.
6. Defines "mobile operating system" to mean an operating system in use on a smartphone or tablet.
7. Defines "opt-out preference signal" to mean a signal that complies with the requirements of this legislation and communicates the consumer’s choice to opt out of the sale and sharing of the consumer's personal information.
8. Authorizes the California Privacy Protection Agency to use its regulatory process to implement the provisions of the bill.

COMMENTS

Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only has our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed "surveillance capitalism" by social psychologist Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the “normal” economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

The slow erosion of privacy, through the collection of what seem to be relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor Danielle Citron warned in an interview with The Guardian in 2022, "We don't viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us."^[3]

With the rapid growth in the development of Artificial Intelligence (AI) systems, particularly large-language models, people’s personal information has become even more valuable as developers require ever-increasing amounts of data to train their foundation models. Going forward, AI development will continue to increase developers' hunger for training data, fueling an even greater race for data acquisition than we have already seen in past decades.^[4]

Challenges with California's privacy laws. In 1972, at the Legislature's urging, the people of California used the initiative process to add "privacy" to the list of "inalienable rights" in the state constitution.^[5] Proponents noted the initiative was specifically designed to preserve Californians' private lives and fundamental rights in the face of technological advances. They argued: "The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . ."^[6]

In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA)(AB 375 (Chau, Chap. 55, Stats. 2018)), which gave consumers certain rights regarding their personal information,^[7] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. Chief among these rights was the right of a consumer to limit a business's use of sensitive personal.^[8] With the passage of the CCPA and the CPRA, California, at the time, had the most comprehensive laws in the country when it came to protecting consumers' rights to privacy.

Since the passage of the CCPA, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to

"opt in" to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[9] In the states that have come after California, privacy is the default. The CCPA, on the other hand, relies on consumers actively exercising their rights to "opt out" of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer often does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

The California Privacy Protection Agency, sponsors of the bill, write in support:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them, in a single step, to send an opt-out request to every site with which they interact online. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020, and the CPPA's regulations, adopted in 2023, update the opt-out preference signal requirement.

[. . .]

The lack of signal uptake by browsers has created a burden for consumers. Today, to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, consumers must either find one of the few privacy-focused browsers or take extra steps to locate and download a browser plugin created by third-party developers that adds support for such signals, which can introduce additional privacy and security concerns. Further, consumers accessing the internet through an Apple mobile device have no access to these signals.

Arguments in Opposition

In opposition to the bill, the California Chamber of Commerce, along with a number of other business organizations, argues:

First and foremost, it is important to know that voters already allowed for businesses to incorporate and recognize opt-out preference signals under the CCPA when they passed Proposition 24. However, in contrast to AB 566, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; instead, it provides businesses the option and required the California Privacy Protection Agency. . . to adopt regulations around that voluntary use.

FISCAL COMMENTS

Minor and absorbable costs to the California Privacy Protection Agency (Privacy Agency) to issue regulations and enforce the opt-out preference signal requirement. The Privacy Agency anticipates initial costs will be absorbable but its Legal Division may seek additional resources if recurring rulemaking is necessary in the future.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-6

YES: Berman, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wilson

ABS, ABST OR NV: Bauer-Kahan, Dixon, DeMaio, Macedo, Patterson, Petrie-Norris

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

UPDATED

VERSION: June 2, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0000958

1. Preston, Alex. “The death of privacy.” The Guardian (Aug. 3, 2014) https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. “You Are the Object of a Secret Extraction Operation.” The New York Times (Nov. 12, 2021) https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

4. King, Jennifer and Meinhardt, Caroline. Rethinking Privacy in the AI Era. Human-Cantered Artificial Intelligence at Stanford University (Feb. 2024) https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf. ↑

5. California Proposition 11 (1972), “Constitutional Right to Privacy Amendment.” ↑

6. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

7. Civ. Code Section 1798.140(v). See EXISTING LAW #10(a) for definition. ↑

8. Civ. Code Section 1798.140(ae). See EXISTING LAW #10(b) for definition. ↑

9. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf

   . ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 566

Author:(Lowenthal)

As Amended Ver:April 8, 2025

Majority vote

SUMMARY

This bill requires that internet browsers and mobile operating systems on smartphones and tablets include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt out of the selling and sharing of their personal information.

Major Provisions

1. Prohibits a business from developing or maintaining a browser or mobile operating system that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal on a browser be easy for a reasonable person to locate and configure.
3. Delays implementation of the mobile operating system requirements until six months after the adoption of regulations by the California Privacy Protection Agency (CPPA).
4. Defines "browser" to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
5. Defines "mobile operating system" to mean an operating system in use on a smartphone or tablet.
6. Defines "opt-out preference signal" to mean a signal that complies with the requirements of this legislation and communicates the consumer's choice to opt out of the sale and sharing of the consumer's personal information.
7. Authorizes the California Privacy Protection Agency to use its regulatory process to implement the provisions of the bill.

COMMENTS

Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[1]

Since the time this piece was published, it has become increasingly clear that not only has our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed "surveillance capitalism" by social psychologist Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the "normal" economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more.

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[2]

The slow erosion of privacy, through the collection of what seem to be relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor Danielle Citron warned in an interview with The Guardian in 2022, "We don't viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us."^[3]

With the rapid growth in the development of Artificial Intelligence (AI) systems, particularly large-language models, people's personal information has become even more valuable as developers require ever-increasing amounts of data to train their foundation models. Going forward, AI development will continue to increase developers' hunger for training data, fueling an even greater race for data acquisition than we have already seen in past decades.^[4]

Challenges with California's privacy laws. In 1972, at the Legislature's urging, the people of California used the initiative process to add "privacy" to the list of "inalienable rights" in the state constitution.^[5] Proponents noted the initiative was specifically designed to preserve Californians' private lives and fundamental rights in the face of technological advances. They argued: "The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . ."^[6]

In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA)(AB 375 (Chau), Chapter 55, Statutes of 2018)), which gave consumers certain rights regarding their personal information,^[7] such as the right to: 1) know what personal categories of information about them are collected and sold; 2) request the deletion of personal information; and 3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. Chief among these rights was the right of a consumer to limit a business's use of sensitive personal.^[8] With the passage of the CCPA and the CPRA, California, at the time, had the most comprehensive laws in the country when it came to protecting consumers' rights to privacy.

Since the passage of the CCPA, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to "opt in" to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[9] In the states that have come after California, privacy is the default. The CCPA, on the other hand, relies on consumers actively exercising their rights to "opt out" of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer often does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

According to the Author

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

Arguments in Support

The California Privacy Protection Agency, sponsors of the bill, write in support:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers' ability to exercise their rights to opt-out of sale under the CCPA by enabling them, in a single step, to send an opt-out request to every site with which they interact online. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020, and the CPPA's regulations, adopted in 2023, update the opt-out preference signal requirement.

[. . .]

The lack of signal uptake by browsers has created a burden for consumers. Today, to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, consumers must either find one of the few privacy-focused browsers or take extra steps to locate and download a browser plugin created by third-party developers that adds support for such signals, which can introduce additional privacy and security concerns. Further, consumers accessing the internet through an Apple mobile device have no access to these signals.

Arguments in Opposition

In opposition to the bill, the California Chamber of Commerce, along with a number of other business organizations, argues:

First and foremost, it is important to know that voters already allowed for businesses to incorporate and recognize opt-out preference signals under the CCPA when they passed Proposition 24. However, in contrast to AB 566, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; instead, it provides businesses the option and required the California Privacy Protection Agency. . . to adopt regulations around that voluntary use.

FISCAL COMMENTS

Minor and absorbable costs to the California Privacy Protection Agency (Privacy Agency) to issue regulations and enforce the opt-out preference signal requirement. The Privacy Agency anticipates initial costs will be absorbable but its Legal Division may seek additional resources if recurring rulemaking is necessary in the future.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 9-0-6

YES: Berman, Bryan, Irwin, Lowenthal, McKinnor, Ortega, Pellerin, Ward, Wilson

ABS, ABST OR NV: Bauer-Kahan, Dixon, DeMaio, Macedo, Patterson, Petrie-Norris

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

UPDATED

VERSION: April 8, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0000294

1. Preston, Alex. "The death of privacy." The Guardian (Aug. 3, 2014) https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

2. Zuboff, Shoshana. "You Are the Object of a Secret Extraction Operation." The New York Times (Nov. 12, 2021) https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

3. Clarke, Laurie. "Interview - Law professor Danielle Citron: 'Privacy is essential to human flourishing,'" The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

4. King, Jennifer and Meinhardt, Caroline. Rethinking Privacy in the AI Era. Human-Cantered Artificial Intelligence at Stanford University (Feb. 2024) https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf. ↑

5. California Proposition 11 (1972), "Constitutional Right to Privacy Amendment." ↑

6. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

7. Civ. Code § 1798.140(v). See EXISTING LAW #10(a) for definition. ↑

8. Civ. Code § 1798.140(ae). See EXISTING LAW #10(b) for definition. ↑

9. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf

   . ↑

Date of Hearing: April 23, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 566

Author:(Lowenthal) – As Amended Ver:April 8, 2025

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires an internet browser to include an opt-out preference signal that allows a consumer to automatically exercise their right to opt out of the selling and sharing of the consumer’s personal information.

FISCAL EFFECT:

Minor and absorbable costs to the California Privacy Protection Agency (Privacy Agency) to issue regulations and enforce the opt-out preference signal requirement. The Privacy Agency anticipates initial costs will be absorbable but its Legal Division may seek additional resources if recurring rulemaking is necessary in the future.

COMMENTS:

1. Purpose. This bill is sponsored by the Privacy Agency. According to the author:

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

1. Background. With some exemptions, the California Consumer Privacy Act allows a consumer the right to know what personal information a business has collected about them and to opt out of the sale of their personal information. A consumer can opt out of the sale of their information by using an internet browser that supports an opt-out preference signal or by downloading a third-party browser plug-in. An opt-out preference signal is a signal sent by a third-party platform (like an internet browser or browser plug-in) that tells a website accessed by a user that the user chooses to opt out of the sale and sharing of their personal information. Upon receiving a user’s opt-out privacy signal, a website may not sell or share the user’s personal information, unless the consumer affirmatively grants the website permission to do so.

Currently, most major internet browsers – like Chrome, Safari, and Edge – do not support an opt-out preference signal. While there are a few browsers that support opt-out preference signals and a user may download a plug-in that fulfills the opt-out function in most major browsers, these methods put the onus on individual users to proactively opt out and protect their personal data. This bill instead requires each business with an internet browser used by the general public to develop an opt-out preference signal that consumers can easily find and use to opt-out of having their information collected by the websites they visit. This places the onus for facilitating a user’s ability to opt-out of sale of their information on the companies that operate the browsers – companies that generally also rely on advertising business models that generate profits from the sale of users’ personal information.

1. Prior Legislation. AB 3048 (Lowenthal), of the 2023-24 Legislative Session, was essentially the same as this bill. AB 3048 was vetoed by Governor Newsom, who wrote:

I am concerned…about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 1, 2025

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 566 (

Author:Lowenthal) – As Introduced Ver:February 12, 2025

PROPOSED AMENDMENTS

SUBJECT: California Consumer Privacy Act of 2018: opt-out preference signal

SYNOPSIS

“The right of privacy is an important American heritage and essential to the fundamental rights guaranteed by the First, Third, Fourth, Fifth and Ninth Amendments to the U.S. Constitution. This right should be abridged only when there is compelling public need. Some information may remain as designated public records but only when the availability of such information is clearly in the public interest.”

– Ballot statement

California Proposition 11: Right of Privacy (1972)

Contrary to the privacy that Californians were promised with the passage of Proposition 11 in 1972, Californians are constantly tracked, monitored, and surveilled, both in their own homes and out in public. Virtually every detail of our lives are being commodified: what we read, what websites we visit, whether we are married and have children, our educational level and income bracket, our location, our purchasing habits, our personal interests, our physical fitness, our gender, who our intimate partners are, our health conditions and our religious faith. Technology companies track what we do on and off their platforms, often combining their own information with enormous datasets purchased through the largely unregulated consumer data market.^[1]

This bill, sponsored by the California Privacy Protection Agency and virtually identical to last year’s AB 3048 (Lowenthal), attempts to give Californians a tool to limit the sharing and sale of their personal information. It requires that internet browsers and mobile operating systems on smartphones and tablets include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt out of the selling and sharing of their personal information. The Committee has proposed two amendments in Comment #6. The substantive amendment removes language stating the agency may update the bill’s definitions of “browser” and “mobile operating systems” while retaining the agency’s authority to adopt regulations and necessary to implement the bill. The second amendment is non-substantive and technical in nature.

Along with the sponsor, Consumer Reports, Mozilla, Brave Software, and several other privacy and consumer advocacy organizations support this bill. The California Chamber of Commerce, Tech Net and a number of business and technology associations oppose.

THIS BILL:

1. Prohibits a business from developing or maintaining a browser or mobile operating system that does not include a setting that enables consumers to send an opt-out preference signal to other businesses that the consumer interacts with through the browser.
2. Requires that the opt-out preference signal on a browser be easy for a reasonable person to locate and configure.
3. Delays implementation of the mobile operating system requirements until six months after the adoption of regulations by the California Privacy Protection Agency (CPPA).
4. Defines “browser” to mean an interactive software application that is primarily used by a consumer to access websites on the internet.
5. Defines “mobile operating system” to mean an operating system in use on a smartphone or tablet.
6. Defines “opt-out preference signal” to mean a signal that complies with the requirements of this legislation and communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information.
7. Authorizes the California Privacy Protection Agency to use its regulatory process to change the statutory definition of “browser” and “mobile operating system” in order to address changes in technology, data collection, obstacles to implementation or privacy concerns.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these is the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
3. Establishes the California Consumer Privacy Act (CCPA). (Civ. Code §§ 1798.100-1798.199.100.)
4. Prohibits a business from selling or sharing the personal information of a child that is 16 years of age or younger, if the business has actual knowledge of the child’s age, unless the child, or the child’s parent or guardian in the case of children less than 13 years old has affirmatively authorized the sharing of selling of the personal information. (Civ. Code § 1798.120(c).)
5. Provides a consumer, subject to exemptions and qualifications, various rights, including the following:
   1. The right to know the business or commercial purpose for collecting, selling, or sharing personal information and the categories of persons to whom the business discloses personal information. (Civ. Code § 1798.110.)
   2. The right to request that a business disclose the specific pieces of information the business has collected about the consumer, and the categories of third parties to whom the personal information was disclosed. (Civ. Code § 1798.110.)
   3. The right to request deletion of personal information that a business has collected from the consumer. (Civ. Code § 1798.105.)
   4. The right to opt-out of the sale of the consumer’s personal information if the consumer is over 16 years of age. (Sale of the personal information of a consumer below the age of 16 is barred unless the minor opts-in to its sale.) (Civ. Code § 1798.12.)
   5. The right to direct a business that collects sensitive personal information about the consumer to limit its use of that information to specified necessary uses. (Civ. Code § 1798.121.)
   6. The right to equal service and price, despite the consumer’s exercise of any of these rights, unless the difference in price is reasonably related to the value of the customer’s data. (Civ. Code § 1798.125.)
6. Requires a business to provide clear and conspicuous links on its homepage allowing consumers to opt-out of the sale or sharing of their personal information and use or disclosure of their sensitive personal information. (Civ. Code § 1798.135(a).)
7. Allows a business to not comply with the requirement to provide opt-out links if the business allows consumers to opt-out of the sale, sharing, and use of their information through an opt-out preference signal sent with the consumer’s consent by a platform, technology, or mechanism based on the technical specifications set forth in the Privacy Agency’s regulations. (Civ. Code § 1798.135(b).)
8. Establishes the California Privacy Protection Agency (Privacy Agency), vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
9. Requires the Privacy Agency to issue regulations that:
   1. Define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumer’s intent to opt-out of the sale or sharing of the consumer’s personal information and to limit the use or disclosure of the consumer’s sensitive personal information.
   2. Establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age and less than 16 years of age. (Civ. Code § 1798.185.)
10. Defines the following terms under the CCPA:
    1. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
       1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
       2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
       3. Biometric information.
       4. Internet activity information, including browsing history and search history.
       5. Geolocation data.
       6. Audio, electronic, visual, thermal, olfactory, or similar information.
       7. Professional or employment-related information. (Civ. Code § 1798.140(v).)
    2. “Sensitive personal information” means personal information that reveals a person’s:
       1. Social security, driver’s license, state identification card, or passport number.
       2. Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials.
       3. Precise geolocation.
       4. Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
       5. Email, mail and text messages.
       6. Genetic data.
       7. Information collected and analyzed relating to health.
       8. Information concerning sex life or sexual orientation. (Civ. Code § 1798.140(ae).)

COMMENTS:

1) Author’s statement. According to the author:

Californians have the right to easily opt-out of the sale of their personal information through opt-out preference signals, yet a significant number of leading web browsers do not offer such signals. Consumers are often unaware of how their data is being collected and shared when they are using the internet, which leads to the misuse of their personal data.

AB 566 makes it easier for consumers to state their privacy preferences from the start by requiring web browsers to allow a user to exercise their opt-out rights at all businesses with which they interact online in a single step.

2) Surveillance capitalism. For almost 20 years experts have been warning us about the erosion of our private lives. They note that this erosion is happening one small bit at a time, likely without people even noticing. With the advent of the internet and advances in technology, it is no longer easy for people to decide which aspects of their lives should be publicly disclosed. As Alex Preston noted in The Guardian a decade ago:

We have come to the end of privacy; our private lives, as our grandparents would have recognised them, have been winnowed away to the realm of the shameful and secret. . . . Insidiously, through small concessions that only mounted up over time, we have signed away rights and privileges that other generations fought for, undermining the very cornerstones of our personalities in the process. While outposts of civilisation fight pyrrhic battles, unplugging themselves from the web. . . the rest of us have come to accept that the majority of our social, financial and even sexual interactions take place over the internet and that someone, somewhere, whether state, press or corporation, is watching.^[2]

Since the time this piece was published, it has become increasingly clear that not only has our right to privacy significantly eroded, but our private information and activities are now being harvested and sold for a profit. This commodification of personal information has been dubbed “surveillance capitalism” by social psychologist Shoshana Zuboff. In an opinion piece for The New York Times, in 2021, Dr. Zuboff warned:

As we move into the third decade of the 21st century, surveillance capitalism is the dominant economic institution of our time. In the absence of countervailing law, this system successfully mediates nearly every aspect of human engagement with digital information. The promise of the surveillance dividend now draws surveillance economics into the “normal” economy, from insurance, retail, banking and finance to agriculture, automobiles, education, health care and more. . . .

An economic order founded on the secret massive-scale extraction of human data assumes the destruction of privacy as a nonnegotiable condition of its business operations. With privacy out of the way, ill-gotten human data are concentrated within private corporations, where they are claimed as corporate assets to be deployed at will.^[3]

The slow erosion of privacy, through the collection of what seem to be relatively small pieces of personal information may not cause people to be overly concerned. However, the private information being amassed on everyone in the United States that is being made available to individuals, private companies, and local, state, and federal government agencies should alarm everyone. University of Virginia Law Professor Danielle Citron warned in an interview with The Guardian in 2022, “We don’t viscerally appreciate the ways in which companies and governments surveil our lives by amassing intimate information about our bodies, our health, our closest relationships, our sexual activities and our innermost thoughts. Companies are selling this information to data brokers, who are compiling dossiers with about 3,000 data points on each of us.”^[4]

With the rapid growth in the development of Artificial Intelligence (AI) systems, particularly large-language models, people’s personal information has become even more valuable as developers require ever-increasing amounts of data to train their foundation models. Going forward, AI development will continue to increase developers’ hunger for training data, fueling an even greater race for data acquisition than we have already seen in past decades.^[5]

3) Why protecting personal information is important. Some may consider sharing their private information, including websites they visit, purchases, employment history, menstrual cycles, name, pictures, locations and movements, social media posts and reactions, and other seemingly innocuous information a reasonable price to pay for freely accessing the internet. However, failing to actively protect our private information can have real world consequences. As an example, dating app, Grindr, was fined 10 percent of its global annual revenue by the Norwegian Data Protection Authority in 2021 for sharing deeply personal information with advertisers, including location, sexual orientation and mental health details.^[6] This was not the first time Grindr had failed to protect their users’ private information. Several years earlier, it was revealed that the company had shared HIV status and the location data from their users with two companies who were contracted to optimize the Grindr platform.^[7]

Catherine Powell in a 2023 blog post for the Council on Foreign Affairs highlights the ubiquitous plundering of people’s personal, intimate data:

If you’ve engaged with any form of technology recently—whether through a smartphone, social media, a fitness tracker, even a seemingly innocuous game like Candy Crush—you have accumulated a substantial amount of intimate privacy data. Intimate data ranges from your location, to when you fall asleep, to even more closely guarded information like your menstrual cycle or sexual partners. And every day, this data is scraped, bought, and sold by data brokers to third parties. Beyond violating our privacy, this repurposing of our personal data undermines our security.^[8]

4) Challenges with California’s privacy laws. In 1972, at the Legislature’s urging, the people of California used the initiative process to add “privacy” to the list of “inalienable rights” in the state constitution.^[9] Proponents noted the initiative was specifically designed to preserve Californians’ private lives and fundamental rights in the face of technological advances. They argued: “The right of privacy is the right to be left alone. . . . It prevents government and business interests from collecting and stockpiling unnecessary information about us and from misusing information gathered for one purpose in order to serve other purposes. . . .”^[10]

In 2018, the Legislature enacted the California Consumer Privacy Act (CCPA)(AB 375 (Chau, Chap. 55, Stats. 2018)), which gave consumers certain rights regarding their personal information,^[11] such as the right to: (1) know what personal categories of information about them are collected and sold; (2) request the deletion of personal information; and (3) opt-out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. Chief among these rights was the right of a consumer to limit a business’s use of sensitive personal.^[12] With the passage of the CCPA and the CPRA, California, at the time, had the most comprehensive laws in the country when it came to protecting consumers’ rights to privacy.

Since the passage of the CCPA, 19 additional states have passed comprehensive privacy laws. Of those states, 17 have laws that are more privacy protective. 16 states require consumers to “opt in” to the sharing and sale of sensitive information and one state, Maryland, prohibits the sharing of sensitive information entirely.^[13] In the states that have come after California, privacy is the default. The CCPA, on the other hand, relies on consumers actively exercising their rights to “opt out” of the sharing and sale of their personal information and the sharing, sale and use of their sensitive personal information. The challenge is that in order to exercise those rights, consumers must first find the businesses that have collected their personal information and then find a way to contact the company to exercise those rights. It is likely that the average consumer often does not even realize that their personal information is being harvested, used to micro target them for advertising, and sold as a commodity to other companies.

One could argue that the State’s current consumer privacy laws fall short of the protections envisioned by the Legislature and the voters in 1972. The proponents argued for a much more stringent level of protection – the right to be left alone. The authors of the proposition promised that adding a right to privacy would ensure the protection of “our homes, our families, thoughts, our emotions, our expressions, our personalities, our freedom of communion, and our freedom to associate with the people we choose.”^[14] In 2025, a person would be hard-pressed to find that level of privacy in their homes, much less outside of those formerly private spheres.

5) Governor’s veto of AB 3048 (Lowenthal, 2024). This bill is essentially identical to a bill proposed by the author last year that was vetoed by the Governor. In his veto message, the Governor noted:

I am concerned . . . about placing a mandate on operating system (OS) developers at this time. No major mobile OS incorporates an option for an opt-out signal. By contrast, most internet browsers either include such an option or, if users choose, they can download a plug-in with the same functionality. To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.

However, in arguing for the ease of adding an opt-out signal for operating systems and search engines, Consumer Reports argues in their support letter:

Browser and platform vendors could easily add universal opt-out functionality to their products. In 2011, in response to urging from the Federal Trade Commission, all major browsers added an option to send “Do Not Track” signals within a matter of months, despite the fact that “Do Not Track” had no clear meaning or legal effect.

While not an opt-out signal in terms of sharing and selling personal information, Apple’s universal opt-out feature, which was added to their operating system a several years ago, allows users to universally opt out of giving app developers permission to track the users’ activities across other applications. This means any app that tries to ask for a user’s permission will be automatically blocked from asking to track the user and informed of the user’s preference to opt out of tracking. Thus, supporters contend that the essential design question has, in effect, been addressed by at least one major developer.

In response to the Governor’s veto, the Privacy Agency notes:

Consistent with the Governor’s comments, AB 566 would leave room for stakeholders, including developers, to help determine the best methods of recognizing and implementing the opt-out preference signals. Using an opt-out preference signal is the single most important step a California consumer can take to protect their privacy. In light of significant changes on the federal level, it is more important than ever that Californians are able to protect their privacy.

While it is true that no major mobile OS incorporates an option for an opt-out signal, requiring mobile operating systems to offer opt-out preference signals would enable consumers to stop the sale and sharing of their personal information by all apps in a single step. Thus, it protects the primary way consumers, including many children, use the internet – through apps on their phones. Clearly, existing protections are not enough. Apps commonly share personal information with ad networks on Android devices, and a number of apps have claimed that they can circumvent Apple’s privacy features - including Shopify and Google, Meta, and Spotify.

Through this bill, we seek to continue to work with stakeholders, learn how they might envision such a tool, and identify the best path forward. In addition, the CPPA is committed to working with stakeholders to develop regulatory specifications that work with their systems before a mobile requirement would go into effect.

6) What this bill would do. As noted above, in order for a consumer to exercise their privacy rights, they must affirmatively opt out of the sharing and selling of their personal information on every website and with virtually every business they interact with. Currently, in order to take advantage of a universal opt-out preference signal to submit opt-out requests under California law, consumers must either use one of the few browsers that support an opt-out preference signal or take additional steps to locate and download a third-party browser plugin that adds support for such signals.

This bill, would require that all search platforms and mobile operating systems develop a universal opt-out preference signal for users. This universal opt-out allows a consumer to toggle a switch on their internet browser or in their mobile device settings that sends a signal on behalf of the consumer communicating their decision to opt out of the sale and sharing of their personal information. Thus allowing users to communicate privacy preferences to the host of the websites rather than having to manually indicate the user’s preferences on each website the user visits. Upon receiving this signal, websites cannot sell or share the consumer’s personal information absent some affirmative action from the consumer granting permission to the respective website.

7) Amendments. The author has agreed to make two amendments. The first would delete the language authorizing the Privacy Agency to change the statutory definitions of “browser” and “mobile operating system” through their regulatory process. Specifically, the amendment does the following:

(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure. and updating the definitions of “browser” and “mobile operating system” to address changes in technology, data collection, obstacles to implementation, or privacy concerns.

Second, opposition notes that the bill in print contains the confusing construction, “[u]nless otherwise prohibited by federal law, a business shall not …” Because preemption does not appear to be a clear concern and, in any event, would apply regardless of whether this bill acknowledges federal law, the author has agreed to the following technical amendment to remove the language in the bill:

(a) (1) Unless otherwise prohibited by federal law, a A business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.

ARGUMENTS IN SUPPORT: The California Privacy Protection Agency, sponsors of the bill, write in support:

Opt-out preference signals like the Global Privacy Control (GPC) are important innovations as they significantly simplify consumers’ ability to exercise their rights to opt-out of sale under the CCPA by enabling them, in a single step, to send an opt-out request to every site with which they interact online. The California Consumer Privacy Act of 2018 (CCPA) currently requires businesses to honor opt-out preference signals as a request to opt-out of the sale of their personal information. The California Department of Justice included this in their CCPA regulations, adopted in 2020, and the CPPA’s regulations, adopted in 2023, update the opt-out preference signal requirement.

However, only a handful of browsers currently offer native support for opt-out preference signals. Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share—have declined to offer these signals. Importantly, none are loaded onto devices by default.

The lack of signal uptake by browsers has created a burden for consumers. Today, to take advantage of their right to use an opt-out preference signal to submit opt-out requests under California law, consumers must either find one of the few privacy-focused browsers or take extra steps to locate and download a browser plugin created by third-party developers that adds support for such signals, which can introduce additional privacy and security concerns. Further, consumers accessing the internet through an Apple mobile device have no access to these signals.

ARGUMENTS IN OPPOSITION: In opposition to the bill, the California Chamber of Commerce, along with a number of other business organizations, raises a number of concerns about the bill. They argue:

First and foremost, it is important to know that voters already allowed for businesses to incorporate and recognize opt-out preference signals under the CCPA when they passed Proposition 24. However, in contrast to AB 566, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; instead, it provides businesses the option and required the California Privacy Protection Agency. . . to adopt regulations around that voluntary use.

[. . .]

Because the scope of universal opt-out preference mechanisms is inconsistent across other jurisdictions, it is unclear how a user agent (i.e., a software agent responsible for retrieving and facilitating end-user interaction with web content) such as a browser or operating system can or should properly communicate an opt-out preference signal in a way that is made clear to a consumer.

[. . .]

In addition to problems and ambiguities highlighted above, it is unclear how an opt-out mechanism browser setting would need to intersect with other privacy related user settings which control similar functionality, and which a user has interacted with (e.g., Google privacy settings, iOS privacy settings, AdChoices), or how those settings may override a universal opt-out signal setting depending on the jurisdiction.

REGISTERED SUPPORT / OPPOSITION:

Support

California Privacy Protection Agency (Sponsor)
Brave Software
Center for Democracy and Technology
Center for Digital Democracy
Center for Economic Justice
Check My Ads
Common Sense Media
Concept Art Association
Consumer Action
Consumer Attorneys of California
Consumer Federation of America
Consumer Reports
Consumer Watchdog
Digital Content Next
Electronic Frontier Foundation
Electronic Privacy Information Center (EPIC)
Los Angeles County Democratic Party
Mozilla
Oakland Privacy
Privacy Researchers and Academics
Privacy Rights Clearinghouse
Santa Monica Democratic Club
Secure Justice
Virginia Citizens Consumer Council

Opposition

American Advertising Federation (AAF)
American Association of Advertising Agencies (4A's)
Association of National Advertisers
California Chamber of Commerce
California Retailers Association
Chamber of Progress
Computer and Communications Industry Association
Connected Commerce Council
Digital Advertising Alliance
Insights Association
Interactive Advertising Bureau
Software Information Industry Association
Technet
Valley Industry and Commerce Association (VICA)

Oppose Unless Amended

Calbroadband
Network Advertising Initiative

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. A Look Behind the Screens: Examining the Data Practices of Social Media and Video Streaming Services. “Preface” by Samuel Levine, Director, Bureau of Consumer Protection, Federal Trade Commission (September 2024) https://www.ftc.gov/system/files/ftc_gov/pdf/Social-Media-6b-Report-9-11-2024.pdf. ↑

2. Preston, Alex. “The death of privacy.” The Guardian (Aug. 3, 2014) https://www.theguardian.com/world/2014/aug/03/internet-death-privacy-google-facebook-alex-preston. ↑

3. Zuboff, Shoshana. “You Are the Object of a Secret Extraction Operation.” The New York Times (Nov. 12, 2021) https://www.nytimes.com/2021/11/12/opinion/facebook-privacy.html. ↑

4. Clarke, Laurie. “Interview - Law professor Danielle Citron: ‘Privacy is essential to human flourishing,’” The Guardian (Oct. 2, 2022) https://www.theguardian.com/technology/2022/oct/02/danielle-citron-privacy-is-essential-to-human-flourishing. ↑

5. King, Jennifer and Meinhardt, Caroline. Rethinking Privacy in the AI Era. Human-Cantered Artificial Intelligence at Stanford University (Feb. 2024) https://hai-production.s3.amazonaws.com/files/2024-02/White-Paper-Rethinking-Privacy-AI-Era.pdf. ↑

6. Hern, Alex. “Grindr fined £8.6m in Norway over sharing personal information,” The Guardian (Jan. 26, 2021) https://www.theguardian.com/technology/2021/jan/26/grindr-fined-norway-sharing-personal-information. ↑

7. “Grindr shared information about users’ HIV status with third parties.” The Guardian (Apr. 3, 2018) https://www.theguardian.com/technology/2018/apr/03/grindr-shared-information-about-users-hiv-status-with-third-parties. ↑

8. Powell, Catherine. “Data is the New Gold, But May Threaten Democracy and Dignity,” Council on Foreign Relations (Jan. 5, 2023) https://www.cfr.org/blog/data-new-gold-may-threaten-democracy-and-dignity-0. ↑

9. California Proposition 11 (1972), “Constitutional Right to Privacy Amendment.” ↑

10. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props. ↑

11. Civ. Code § 1798.140(v). See EXISTING LAW #10(a) for definition. ↑

12. Civ. Code § 1798.140(ae). See EXISTING LAW #10(b) for definition. ↑

13. A comparison chart of state privacy laws can be accessed at https://45555314.fs1.hubspotusercontent-na1.net/hubfs/45555314/Slides%20and%20one-pagers/US%20state%20law%20comparison%20chart_2024_July_1.pdf. ↑

14. Right of Privacy California Proposition 11, UC L. SF SCHOLARSHIP REPOSITORY (1972), pp. 26–27, https://repository.uclawsf.edu/cgi/viewcontent.cgi?article=1761&context=ca_ballot_props.. ↑