• by Wendy Davis  @wendyndavis, September 23, 2024

California Governor Gavin Newsom has vetoed a bill that would have required browser developers including Google, Apple and Microsoft to offer a tool enabling consumers to easily opt out of online behavioral advertising across the web.

The measure (AB 3048) specifically would have prohibited companies from maintaining web browsers that lack an opt-out mechanism that's “easy for a reasonable person to locate and configure.”

The best-known universal opt-out mechanism is the Global Privacy Control, a tool created by privacy advocates that sends opt-out signals to every site consumers visit. Some developers -- including Mozilla, Brave and DuckDuckGo -- have already built the Global Privacy Control into their browsers.

When Newsom vetoed the bill, he expressed concerns about mandating tools for operating systems.

He said in a statement accompanying the veto that no major mobile operating system incorporates a global opt-out mechanism, and that most internet browsers either offer an opt-out mechanism, or allow for downloadable plug-ins.

“To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators,” he stated Friday.

The ad industry had opposed the bill, arguing it wasn't necessary.

The Association of National Advertisers cheered news of the veto.

“This bill simply created new regulations without improving privacy or helping Californians, and we hope the legislature will allow this worthy veto to stand," Chris Oswald, executive vice president of the organization stated.

The bill, introduced earlier this year by California Assemblymember Josh Lowenthal (D-69th District), was sponsored by the California Privacy Protection Agency and endorsed by advocacy groups.

Consumer Reports, which supported the bill, called the veto disappointing.

“We strongly disagree with the idea expressed in the governor’s veto statement that it should be left to operating systems to provide privacy choices for consumers,” Consumer Reports policy analyst Matt Schwartz stated. “They’ve shown time and again they won’t meaningfully do so until forced.”  

California's privacy law currently gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites.

In the absence of a universal opt-out mechanism, people who don't want to receive ads targeted based on cross-site data can click on individual companies' opt-out links, or use a tool created by an ad industry organization to opt out of many ad-tech companies' behavioral-targeting platforms.

But advocates say those those methods can be cumbersome. Supporters of the bill said in a letter sent to Newsom earlier this month that the proposed law would “will help reduce opt-out friction and make it easier for California residents to control their data.”