• by Wendy Davis  @wendyndavis, May 24, 2024

The California Assembly overwhelmingly passed a bill that would require browser developers to offer a tool that allows consumers to easily opt out of online behavioral advertising throughout the web.

The measure (AB 3048), introduced earlier this year by California Assemblymember Josh Lowenthal (D-69th District) and passed Wednesday by a vote of 53-7, is now with the state Senate's rules committee.

The bill specifically would prohibit companies from developing or maintaining web browsers that lack an opt-out preference setting. The best known example is the Global Privacy Control -- a tool created by privacy advocates that sends opt-out signals to every site consumers visit.

In the absence of a global setting, consumers who want to reject receiving ads targeted based on cross-site data can click on individual companies' opt-out links, or use a tool created by an ad industry organization to opt out of many ad-tech companies' behavioral-targeting platforms.

Privacy advocates have said those methods fall short for several reasons, including that consumers can't always find opt-out links, and that opting out site-by-site can be cumbersome.

California's Consumer Privacy Rights Act currently gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites. The state privacy agency has interpreted that law as requiring companies to honor opt-out requests that consumers transmit through browser-based tools.

Other states including Colorado, Connecticut, Delaware, Montana and Texas have recently passed laws or regulations explicitly mandating that companies honor universal opt-out mechanisms -- but some specifics vary. For instance, Texas only requires companies to honor a global opt-outs if that business does so in other states.

Business and advertising groups oppose AB 3048, arguing in a letter sent to California lawmakers in March that universal opt-out mechanisms raise “unanswered policy questions,” including how the signals will be treated different jurisdictions.

Universal opt-out preference tools "are not yet ripe to consider as a device- or browser-mandated option,” wrote the California Chamber of Commerce, American Association of Advertising Agencies, Association of National Advertisers and eight other groups.

Those entities also argued that California's privacy law (which they refer to as Proposition 24) doesn't require companies to honor browser-based signals, but instead allows companies to either place an opt-out link on their home page or honor a browser-based signal.

“In contrast to AB 3048, Proposition 24 does not actually mandate businesses to provide a global opt-out signal; it provides businesses the option and requires regulations around that voluntary use,” the groups wrote.

Advocacy groups including Consumer Reports and the Electronic Privacy Information Center, along with trade organization Digital Content Next (which represents publishers), support the bill.

Those groups said in a letter sent to state lawmakers in March that the proposed law “will help reduce opt-out friction and make it easier for California residents to control their data.”

“Today, if a user wants to send an opt-out preference signal on Chrome, Safari, or Edge, they need to download a third-party extension to do so, while a mobile platform user cannot configure their device to send an opt-out preference signal at all,” those groups wrote. “As a result, millions of Californians, while technically enjoying the right to send such a signal, likely have no idea that this right even exists and have no easy way of acting on it even if they did.”

Some developers including Mozilla, Brave and Duck Duck Go have already built the Global Privacy Control into their browsers.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Google's Chrome doesn't include the specific “Global Privacy Control” setting, but has long had a “do-not-track” setting, which sends a no-tracking request to all websites consumers visit.

The California privacy agency has suggested that this older “do-not-track” command isn't equivalent to an "opt-out preference signal," but it's not clear whether other state officials will agree -- or whether Google could revise the do-not-track command so that it could serve as an opt-out preference signal.