• by Wendy Davis  @wendyndavis, September 16, 2024

The major ad industry organizations are asking California Governor Gavin Newsom to veto a bill that would require browser developers including Google, Apple and Microsoft to offer a tool enabling consumers to easily opt out of online behavioral advertising across the web.

The bill “is unnecessary, ambiguous, and would significantly harm healthy market competition that benefits California consumers and the economy,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance say in a letter sent to Newsom on Monday.

The measure (AB 3048), introduced by California Assemblymember Josh Lowenthal (D-69th District), was approved by state lawmakers earlier this month and was sent to Newsom on September 6.

The bill, which is sponsored by the California Privacy Protection Agency, would prohibit companies from developing or maintaining web browsers that lack an opt-out mechanism that is “easy for a reasonable person to locate and configure.”

The best-known mechanism like this is the Global Privacy Control, a tool created by privacy advocates that sends opt-out signals to every site consumers visit. Some developers -- including Mozilla, Brave and DuckDuckGo -- have already built the Global Privacy Control into their browsers.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Google's Chrome does not include the specific “Global Privacy Control” setting, but has long had a “do-not-track” setting, which sends a no-tracking request to all websites that consumers visit.

It's not clear whether Google could revise the do-not-track command so that it could serve as an opt-out preference signal.

In the absence of a universal opt-out mechanism, people who don't want to receive ads targeted based on cross-site data can click on individual companies' opt-out links, or use a tool created by an ad industry organization to opt out of many ad-tech companies' behavioral-targeting platforms.

Consumer advocates argue that those methods can be cumbersome, and that consumers can't always find opt-out links.

Privacy advocacy groups and other proponents of the bill recently urged Newsom to sign it, arguing the measure “will help reduce opt-out friction and make it easier for California residents to control their data.”

But ad industry organizations say consumers can already access opt-out preference tools, such as by using a browser that has enabled a universal opt-out mechanism.

The ad industry also argues that the bill would enshrine into law a misinterpretation of the state privacy statute.

The current California privacy law gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites.

The state's privacy agency has interpreted that law as requiring companies to honor opt-out requests that consumers transmit through browser-based tools like the Global Privacy Control.

But the ad organizations argue that the law actually allows companies to choose between placing opt-out links on their home pages or honoring browser-based signals.

The groups say the state agency “turned this option on its head by mandating that businesses honor opt-out preference signals regardless of whether the business provides an opt out means via a footer link.”

The industry organizations also contend that some wording in the bill could harm competition. Specifically, the groups point to a requirement that browsers allow consumers to send opt-out signals to all “businesses with which the consumer interacts through the browser.”

That language doesn't specify whether the signals must also be sent to the browser developer, according to the ad industry groups.

In other words, the law is ambiguous about whether, for instance, Google, would have to respect an opt-out preference signal sent by a Chrome user, according to the industry groups.

“Mandating that browsers and mobile operating systems deploy and maintain opt-out preference signals, effective on all other businesses but the browsers and mobile operating systems themselves, would create anti-competitive results caused by how these intermediaries implement AB 3048’s requirements,” the groups write.