• by Wendy Davis  @wendyndavis, July 14, 2021

California's top law enforcement official says companies that collect residents' personal data must comply with opt-out requests sent through the “Global Privacy Control" -- a tool developed by privacy advocates that enables web users to opt out of the sale of their information on a universal basis.

“For businesses that collect personal information from consumers online, one acceptable method for consumers to opt-out of sales is via a user-enabled global privacy control, like the GPC,” the state attorney general's office states in a newly updated guide to the California Consumer Privacy Act.

“Opting out of the sale of personal information should be easy for consumers, and the GPC is one option for consumers who want to submit requests to opt-out of the sale of personal information via a user-enabled global privacy control,” the guide continues. “Under law, it must be honored by covered businesses as a valid consumer request to stop the sale of personal information.”

California's privacy law gives consumers the right to learn what personal information has been collected about them by companies, have that information deleted, and prevent the sale of that data to third parties.

Regulations crafted by former Attorney General Xavier Becerra require companies to honor global do-not-sell requests -- meaning the companies can't require consumers to opt out on a site-by-site basis.

The Global Privacy Control, first released last October, is available as a downloadable extension and is also available as a setting in some browsers -- including Mozilla's Firefox, Duck Duck Go, and Brave. The tool transmits a do-not-sell request when consumers visit websites.

Most of the major browser developers have long offered “do-not-track” settings, but those signals don't necessarily communicate that users don't want their data “sold,” as that term is defined by California law.

The ad industry has opposed any requirement to honor universal opt-out signals, arguing both that the statute itself doesn't include that mandate, and that the mandate violates advertisers' First Amendment rights.

While the text of the California Consumer Privacy Act doesn't specifically reference global opt-outs, it directs the state attorney general to adopt regulations that would “facilitate and govern the submission of a request by a consumer to opt-out of the sale of personal information.”

Last August, former Attorney General Xavier Becerra finalized regulations that require companies to honor universal opt-outs.

Earlier this year Becerra tweeted his approval of the Global Privacy Control.

That move drew criticism by the ad industry, which argued Becerra was creating “additional confusion for businesses.”

The Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau and American Advertising Federation stated at the time that Becerra “provided no justification for his conclusion, no information on the standards applied to his review, and no information on how or when his office intends to enforce this requirement.”