• by Wendy Davis , 3 hours ago

California lawmakers have passed a bill that would require browser developers to offer a tool enabling consumers to easily opt out of online behavioral advertising throughout the web.

AB 566, unveiled earlier this year by state Assembly member Josh Lowenthal (D-69th District), would prohibit businesses from “developing or maintaining” a web browser that lacks an opt-out preference signal that sends opt-out requests to every site consumers visit.

California's assembly passed the bill in June by a vote of 53-1. The state senate passed an amended version Wednesday by a 31-7 vote, and the assembly granted final approval Thursday. 

The measure now heads to Governor Gavin Newsom who will have until October 13 to either veto the measure or allow it to become law. Last year, he vetoed a similar but slightly broader bill that would have required browsers as well as mobile operating systems to offer a setting enabling people to opt out of all online ad targeting.

At the time, Newsom expressed concerns about mandating tools for mobile operating systems.

“To ensure the ongoing usability of mobile devices, it's best if design questions are first addressed by developers, rather than by regulators,” Newsom stated when he disapproved the measure.

The best known opt-out preference signal is the Global Privacy Control -- a mechanism created by privacy advocates to enable consumers to communicate that they don't consent to the sharing of their online data for ad purposes. Some developers -- including Mozilla, Brave and DuckDuckGo -- have already built the Global Privacy Control into their browsers.

Google's Chrome doesn't include the “Global Privacy Control” setting, but has long had a “do-not-track” setting, which sends a no-tracking request to all websites that consumers visit.

At one time, Apple offered a “do-not-track” setting in Safari, but the company disabled the feature in 2019 due to concerns that ad-tech companies would exploit the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Without a universal opt-out preference signal, consumers who want to reject behaviorally targeted ads can click on web companies' opt-out links one-by-one, or can use a tool created an ad industry group. Those ad industry tool allows people to opt out of multiple companies that belong to industry organizations.

The current bill is sponsored by California's privacy agency and backed by numerous outside watchdogs, including the Center for Democracy and Technology, Consumer Reports, Electronic Frontier Foundation and Electronic Privacy Information Center.

“It is far too difficult for most people to use their existing privacy rights,” Consumer Reports policy analyst Matt Schwartz stated Thursday, after lawmakers passed the bill.

“AB 566 will change that by requiring browser vendors to provide a clear and easy-to-use setting that allows consumers to universally opt-out, preventing their information from being sold or shared with hundreds of third-parties that they have never even heard of," he added.

The industry groups Association of National Advertisers, American Association of Advertising Agencies, American Advertising Federation and Digital Advertising Alliance oppose the measure, arguing both it's unnecessary and that California's privacy law doesn't require companies to honor settings such as the Global Privacy Control.

Those groups argued to lawmakers that California's privacy law "clearly states that opt-out preference signals are optional for businesses to observe."

State regulations implementing the privacy law require companies to honor opt-out preference signals, but the ad groups say those regulations are based on a misinterpretation of the statute.

"Under the law, businesses may either provide a footer link to enable consumers to opt out of sales and sharing or to allow consumers to opt out via an opt-out preference signal. Through regulations, the [California Privacy Protection Agency] turned this option on its head by mandating that businesses must honor opt-out preference signals," the ad groups said in a June letter to California legislators.

"The California legislature should not tolerate or bless state agency regulations that contravene clear provisions in law," the groups add.

The business organization Connected Commerce Council, which lists Google and Amazon as partners, urged members to oppose the bill.

"Contrary to what the bill’s proponents say, that will do little to strengthen individuals’ privacy -- and could badly hurt many of the state’s 4.2 million small businesses," the group stated.

"If people opt out of data sharing -- which many will, because they (mistakenly) believe it will save them from 'surveillance' advertising -- small businesses will lose valuable data-powered tools and insights," the organization added.

Unless vetoed, the bill will take effect in 2027.