• by Wendy Davis  @wendyndavis, August 28, 2024

California's Senate on Tuesday passed a bill that would require browser developers to offer a tool that allows consumers to easily opt out of online behavioral advertising throughout the web.

The measure (AB 3048), introduced earlier this year by California Assemblymember Josh Lowenthal (D-69th District), and approved 31-7 in the Senate, now heads back to the Assembly for final approval.

The bill, which is sponsored by the California Privacy Protection Agency, drew support from a broad array of privacy groups, but is opposed by the Association of National Advertisers and other ad and business organizations.

If signed into law, the bill specifically would prohibit companies from developing or maintaining web browsers that lack an opt-out mechanism that's “easy for a reasonable person to locate and configure.”

The best known universal opt-out mechanism is the Global Privacy Control -- a tool created by privacy advocates that sends opt-out signals to every site consumers visit.

In the absence of a global privacy opt-out tool, people who don't want to receive ads targeted based on cross-site data can click on individual companies' opt-out links, or use a tool created by an ad industry organization to opt out of many ad-tech companies' behavioral-targeting platforms.

Privacy advocates have said those methods can be problematic, arguing that opting out site-by-site can be cumbersome, and that consumers can't always find opt-out links.

California's Consumer Privacy Rights Act gives consumers the right to reject “cross-context” behavioral advertising, and the state privacy agency interprets that law as requiring companies to honor opt-out requests that consumers transmit through browser-based tools.

The Association of National Advertisers, California Chamber of Commerce and other business groups argue against the bill for several reasons. Among others, they dispute that California requires businesses to honor browser-based opt-out signals. Instead, the groups contend, California's law allows companies to choose between placing an opt-out link on their home page or honoring a browser-based signal.

Advocacy groups including Consumer Reports and the Electronic Privacy Information Center, along with trade organization Digital Content Next (which represents publishers), support the bill. Those groups said in a letter sent to state lawmakers in March that the proposed law “will help reduce opt-out friction and make it easier for California residents to control their data.”

Some developers including Mozilla, Brave and Duck Duck Go have already built the Global Privacy Control into their browsers.

Google's Chrome doesn't include the specific “Global Privacy Control” setting, but offers a “do-not-track” setting, which sends a no-tracking request to all websites consumers visit.

The California privacy agency has suggested that this older “do-not-track” command isn't equivalent to an "opt-out preference signal," but it's not clear whether other state officials will agree -- or whether Google could revise the do-not-track command so that it could serve as an opt-out preference signal.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Other states including Colorado, Connecticut, Delaware, Montana and Texas have recently passed laws or regulations explicitly mandating that companies honor universal opt-out mechanisms -- but some specifics vary. For instance, Texas only requires a business to honor a global opt-out mechanism if that business does so in another state.