California Assembly Passes Bill on Opt-Out Preference Signals

On May 24, 2024 the California Assembly passed AB-3048, a new bill which would supplement the CCPA-CPRA’s requirements for consumer opt-out requests. 

The California Consumer Privacy Act of 2018 (CCPA) gives consumers several rights regarding their personal information collected or sold by businesses. This includes the right to tell businesses not to sell or share their personal information with third parties. The California Privacy Rights Act of 2020, approved by voters as Proposition 24, updated and expanded the CCPA. It also created the California Privacy Protection Agency, which has the power to enforce the CCPA.

According to the summary, AB 3048 seeks to update the California Consumer Privacy Act of 2018 (CCPA). It proposes that businesses must include an option in browsers and devices for consumers to easily opt-out of the sale or sharing of their personal information. This change would support the goals of the California Privacy Rights Act of 2020 (CPRA) and give the California Privacy Protection Agency (CPPA) the power to enforce these rules and adjust them as technology and privacy issues evolve.

Back in February of 2024, when the Bill was first introduced by Assembly member Josh Lowenthal, the California Privacy Protection Agency (CPPA) applauded the initiative as it would attempt to bridge the gap in the current privacy landscape by allowing Californians to assert their rights under the CCPA, which recognizes opt-out preferences signals. Despite the availability of such signals in smaller browsers, such as DuckDuckGo, or Mozilla Firefox, larger ones, like Google Chrome, Apple Safari, and Microsoft Edge, which also occupy more than 90% of the market, have yet to offer such signals. 

Recognizing the great potential of this initiative, Ashkan Soltani, Executive Director of the California Privacy Protection Agency, gave the following statement at that time, in regards to the Bill’s introduction: 

All Californians have the right to object to the sale and sharing of their personal information via opt-out preference signals, but most Californians are unable to avail themselves of these important rights because the tools they use to navigate online do not communicate their privacy preferences. It’s high time these vendors let consumers take full advantage of their rights.

If AB 3048 passes, it will add a new section to the California Consumer Privacy Act (CCPA), meaning that  California will join the ranks of other states, such as Colorado, Connecticut, Delaware, Montana, and Texas, all of which have similar provisions in their consumer privacy laws. 

Additionally, browser vendors will need to integrate this feature to comply with the new regulation, ensuring that users' choices are respected and enforced automatically.