• by Wendy Davis , September 4, 2024

Privacy advocacy groups are urging California Governor Gavin Newsom to sign a bill that would require browser developers to offer a tool that allows consumers to easily opt out of online behavioral advertising.

“This bill is vital to ensure that millions of Californians have a practical way to manage their privacy choices,” Consumer Reports, the Electronic Privacy Information Center, Digital Content Next, and others say in a letter sent to Newsom late last week.

The California Chamber of Commerce says it plans to seek a veto, arguing that the bill “will lead to significant confusion and compliance problems as downstream businesses receive conflicting signals, and even more complicated as states adopt different standards for these signals.”

That group, along with the Association of National Advertisers and other business organizations recently urged lawmakers to reject the bill.

The best known universal opt-out mechanism is the Global Privacy Control -- a tool created by privacy advocates that sends opt-out signals to every site consumers visit.

Without such a control, people who don't want to receive ads targeted based on cross-site data can click on individual companies' opt-out links, or use a tool created by an ad industry organization to opt out of many ad-tech companies' behavioral-targeting platforms.

The advocacy groups say the site-by-site opt-out approach “is intensely cumbersome for consumers,” citing a 2020 Consumer Reports investigation concluding that many consumers have trouble opting out from companies' individual sites -- often because they can't find the opt-out links, or the procedure is burdensome, or the companies aren't complying with the law.

“AB 3048 will ensure that consumers have the ability to use their privacy rights by requiring that browser vendors and mobile operating systems include an easy to locate and use setting that enables the consumer to send an opt-out preference signal,” Consumer Reports and the other advocacy groups write. “This bill’s approach will help reduce opt-out friction and make it easier for California residents to control their data.”

California's Consumer Privacy Rights Act gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites. The law includes provisions discussing global opt-out signals, but those provisions appear ambiguous.

The state privacy agency has interpreted the statute as requiring companies to honor opt-out requests that consumers transmit through browser-based tools.

But ad and business organizations dispute that analysis. Instead, the groups contend, California's law allows companies to choose between placing opt-out links on their home pages or honoring a browser-based signal.

That structure "allows businesses the opportunity to implement the most effective method for their particular situation,” the California Chamber of Commerce, Association of National Advertisers, American Association of Advertising Agencies and other business groups argued in a recent letter to state lawmakers.

Some developers including Mozilla, Brave and Duck Duck Go have already built the Global Privacy Control into their browsers.

Google's Chrome doesn't include the specific “Global Privacy Control” setting, but offers a “do-not-track” setting, which sends a no-tracking request to all websites consumers visit, but the California privacy agency has suggested that this older “do-not-track” command isn't equivalent to an "opt-out preference signal.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.