• by Wendy Davis  @wendyndavis, February 13, 2025

For the second year in a row, a California lawmaker has introduced legislation that would require browser developers to offer a tool enabling consumers to opt out of online behavioral advertising throughout the web.

AB 566, unveiled this week by state Assembly member Josh Lowenthal (D-69th District), would prohibit businesses from “developing or maintaining” web browsers that lack an opt-out preference setting.

California lawmakers overwhelmingly passed a nearly identical bill last year, but it was vetoed by Governor Gavin Newsom, who expressed concerns about mandating tools for operating systems.

“To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators,” Newsom stated when he disapproved the measure.

Lowenthal's bill specifies that the preference signal must be “easy for a reasonable person to locate and configure.”

The best known current opt-out preference signal is the Global Privacy Control -- a mechanism created by privacy advocates to enable consumers to communicate that they don't consent to the sharing of their online data for ad purposes. Some developers -- including Mozilla, Brave and DuckDuckGo -- have already built the Global Privacy Control into their browsers.

Google's Chrome doesn't include the “Global Privacy Control” setting, but has long had a “do-not-track” setting, which sends a no-tracking request to all websites that consumers visit.

It's not clear whether Google could revise the do-not-track command so that it could serve as an opt-out preference signal.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Without a universal opt-out preference signal, consumers who want to reject behaviorally targeted ads can click on web companies' opt-out links one-by-one, or can use a tool created an ad industry group. Those ad industry groups' tools allow people to opt out of multiple companies that belong to ad industry organizations.

The ad industry opposed last year's version of the bill, arguing that consumers can already access opt-out tools. Industry groups also argued that the bill would have enshrined into law a misinterpretation of the state privacy statute.

The current California privacy law gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites.

The state's privacy agency has interpreted that law as requiring companies to honor opt-out requests that consumers transmit through browser-based tools like the Global Privacy Control.

But the ad industry argued to Newsom last year that the text of the privacy law actually gives companies a choice between offering an opt-out link on their homepages or honoring opt-out preference signals.

“Under the law, businesses may either provide a footer link to enable consumers to opt out of sales and sharing or to allow consumers to opt out via an opt-out preference signal,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance said in a letter asking Newsom to veto the bill. 

Some privacy advocates have argued that a different provision of the California law mandates companies to honor global opt-outs. That provision says a consumer “may authorize another person” to opt-out of data sharing on the consumer's behalf, and that the authorized opt-out can be effectuated through an opt-out preference signal.

Several other states -- including Colorado, Delaware, Maryland and Oregon -- have recently passed privacy laws that unambiguously require companies to honor universal opt-out signals.