Potential CCPA Update: AB 3048 Seeks Opt-Out Signal Integration

On February 16, 2024, in a move aimed at supporting the digital privacy rights of California consumers, Assembly member Josh Lowenthal introduced AB 3048, a bill also applauded by the California Privacy Protection Agency (CPPA), which if passed, would create an obligation for browser vendors and browser devices to facilitate consumer privacy preferences through opt-out signals. 

The initiative would attempt to bridge the gap in the current privacy landscape by allowing Californians to assert their rights under the CCPA, which recognizes opt-out preferences signals. Despite the availability of such signals in smaller browsers, such as DuckDuckGo, or Mozilla Firefox, larger ones, like Google Chrome, Apple Safari, and Microsoft Edge, which also occupy more than 90% of the market, have yet to offer such signals. 

According to the summary, AB 3048 aims to amend the California Consumer Privacy Act of 2018 (CCPA) by introducing a requirement for businesses to incorporate an opt-out preference signal within browsers and devices, allowing consumers to easily indicate their desire to opt-out of the sale or sharing of their personal information. In doing so, the bill would align with the purposes and intent of the California Privacy Rights Act of 2020 (CPRA), and would empower the California Privacy Protection Agency (CPPA) to enforce its provisions and adapt to technological advancements and privacy challenges through regulation updates.

Ashkan Soltani, Executive Director of the California Privacy Protection Agency, has made the following statement in regards to the Bill’s introduction: 

We thank Assembly member Lowenthal for introducing this important legislation requiring browser vendors to allow consumers to easily exercise the privacy rights guaranteed by California’s best-in-the-nation privacy law [...]. All Californians have the right to object to the sale and sharing of their personal information via opt-out preference signals, but most Californians are unable to avail themselves of these important rights because the tools they use to navigate online do not communicate their privacy preferences. It’s high time these vendors let consumers take full advantage of their rights.

If AB 3048 is passed it would become an additional section of the CCPA and would make California the first US state to mandate an obligation for browser vendors to support opt-out preference signals directly.