Legislation to mandate universal data privacy opt-outs vetoed in California

California Gov. Gavin Newsom (D) vetoed legislation late Friday that would have required internet browsers and mobile operating systems to make it simpler for consumers to prevent the use and sharing of their data across websites.

The vetoed bill would have specifically mandated that browsers and operating systems provide an online tool called an “opt-out preference signal.” 

In a Friday letter to the California State Assembly, Newsom said he was “concerned” about “placing a mandate on operating system developers at this time.”

“No major mobile OS incorporates an option for an opt out signal,” the letter said. “To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators.” 

Newsom pointed out that most internet browsers already include an opt-out option or a downloadable plug-in which allows users to protect their privacy.

Had it passed, the legislation — which was a top priority for the trailblazing California Privacy Protection Agency — would have built on the state’s already tough privacy regulations for businesses and data brokers in particular.

The bill would have impacted a variety of large California-based tech companies — some of which lobbied fiercely against it becoming law — including Google, Microsoft and Apple.

The so-called opt-out preference signal called for in the bill would have allowed consumers to “invoke [their] universal opt-out rights, which means that if you turn it on, you'd be sending a legally binding opt out request under [the California Consumer Privacy Act] to all of the businesses on that platform,” Consumer Reports’ policy analyst Matt Schwartz told Recorded Future News.

California businesses are already required to respond to universal opt-out signals, Schwartz said, but there isn't an easy way for consumers to find and use the signals.

“Major platforms… where people would normally encounter [the signals] aren't providing them,” Schwartz said. “You have to download third party browser extensions to send [opt-out requests], and most people don't even know that's an option.”

Because the legislation could have been “marketplace shaping,” Schwartz said he was not entirely surprised to see it vetoed.

If the bill had passed it would shift the number of people who opt out of data collection and sharing from a relatively small number of Californians to potentially millions, Schwartz said.

“I think that's why you saw Google, for example, go all out in lobbying against this bill,” Schwartz said. “It does get to the heart of how they make their money by tracking users, and they convinced Governor Newsom that that was worth more than protecting consumers’ privacy.”