California passes landmark bill requiring easier data sharing opt outs for consumers

California legislators on Wednesday passed a bill which requires internet browsers and mobile operating systems to allow consumers to easily opt out from the sharing and selling of their private data with websites which use it for targeted advertising.

State residents already have the right to send legally binding opt out requests — a provision established under the pioneering California Consumer Privacy Act — but browsers like Google Chrome, Safari and Edge, along with Android and iOS mobile platforms, do not currently offer tools for doing so, forcing consumers to download third-party software.

The new legislation creates an “opt-out preference signal” tool which would let citizens opt out of sharing their information by simply pushing a button to activate the signal on their internet browser, which would then send opt out requests to every website consumers visit by default.

The state’s Senate passed the landmark legislation after the General Assembly approved it late Wednesday. The Senate then added amendments to the bill which now goes back to the Assembly for final sign off before it is sent to the governor’s desk, a process Matt Schwartz, a policy analyst at Consumer Reports, called a “formality.”

California, long a bellwether for privacy regulation, now sets an example for other states which could offer the same protections and in doing so dramatically disrupt the online advertising ecosystem, according to Schwartz

“If folks use it, [the new tool] could severely impact businesses that make their revenue from monetizing consumers’ data,” Schwartz said in an interview with Recorded Future News. “You could go from relatively small numbers of individuals taking advantage of this right now to potentially millions and that's going to have a big impact.”

As it stands, many Californians don’t know they have the right to opt out because the option is invisible on their browsers, a fact which Schwartz said has “artificially suppressed” the existing regulation’s intended effects. 

“It shouldn't be that hard to send the universal opt out signal,” Schwartz added. “This will require [browsers and mobile operating systems] to make that setting easy to use and find.”

If California Gov. Gavin Newsom signs the legislation, browsers will be required to offer a mandatory toggle allowing consumers to send an opt out request to every website they visit. 

Operating systems also will need to feature the toggle, most likely as a system setting, and then the opt-out request will be sent to all covered businesses that a given consumer engages with on the operating system, including apps, Schwartz said.

Schwartz said he hopes the California legislation will inspire other states, noting that of the roughly 19 states that now have comprehensive data privacy policies on the books, about half already require that companies’ honor consumers’ universal opt out requests.

“All of those states are capable of passing a bill like this to up the ante,” Schwartz said, noting that in all of those states the reality is that, as with California now, the universal opt out option is effectively invisible to consumers.

“We're optimistic that the idea will catch on,” Schwartz said.

Correction: An earlier version of this story misstated how the operating system toggle will work.