California Privacy Protection Agency Board Approves Legislative Proposal to Require Browsers to Offer Opt-out Preference Signals

On December 8, 2023, the California Privacy Protection Agency (CPPA) Board voted 5-0 at its meeting to advance a legislative proposal to require browser vendors to include a feature that allows users to exercise their California privacy rights through opt-out preference signals. This recent unanimous decision marks a significant stride toward fortifying consumer privacy rights in the digital realm. Although it is geared toward California privacy rights, all privacy experts and businesses must take notice as this decision is likely to find it way in other state privacy laws and amendments.

What is an Opt-Out Preference Signal?

An “opt-out preference signal, also known colloquially as Global Privacy Control (GPC), allows a consumer to opt-out of sale and sharing of their personal information with all businesses they interact with online without having to make individualized requests with each business.

What is Currently Required?

Under the CCPA, businesses are required to honor opt-out preference signals as a request to opt-out of sale/sharing. If the proposal is adopted, California would be the first state to require browser vendors to offer consumers the option to enable these signals. Privacy experts — such as our Data Privacy & Cybersecurity team — expect some movement from the states requiring businesses to honor browser privacy signals as an opt out of the sale of personal data, such as Colorado^[1], Connecticut, Delaware, Montana, Oregon, and Texas.

Key Board Remarks

 Attending the Board’s meetings not only provides the thought process behind the Board’s decisions but also the trending theme of the basis for the Board’s decisions.

CPPA Executive Director, Ashkan Soltani, remarked, “If approved through the California legislative process, this proposal will not only advance Californians’ consumer privacy, but help incentivize the development of privacy-enhancing technologies.” CPPA Deputy Director of Policy and Legislation commented, “Opt-out preference signals are a powerful tool to help consumers protect their privacy rights.”

At the meeting, it became abundantly clear that the CPPA’s goal is to limit a consumer’s obligation to place hundreds of individualized requests to protect their personal information. GPC is a Board preference because it aids the bigger goal of “making it easier for California consumers to exercise their privacy rights.”

Many Consumers & Business are Looking for the Difference. What is It?

Currently, to exercise the opt-out right online, consumers must either use a browser that supports an opt-out preference signal or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals.

The Board’s consideration of the current landscape sheds light on the limited availability of browsers with native support for opt-out preference signals, highlighting Mozilla Firefox, DuckDuckGo, and Brave, which collectively account for less than 10% of the global desktop browser market. The Board noted that none of these browser options are loaded onto devices by default. Download by default options allow consumers to learn about options more easily. Without pre-loaded options with opt-out support, it is more difficult for consumers to learn about and take advantage of these protections.

The materials reviewed by the Board also showed that the browsers making up 90% of the desktop browser market share, like Google Chrome, Microsoft Edge, and Apple Safari, all declined to offer GPCs (opt-out preference signals). In navigating these challenges, the CPPA is not only addressing the technical aspects but also acknowledging the economic dynamics at play, noting the reluctance of major browser providers to adopt GPCs due to their reliance on advertising-based business models.

Conclusion

In summary, GPC will streamline the process for Californians to exercise their right to opt-out of the sale and sharing of personal information across all online interactions. The remarks from key figures within the CPPA underscore the commitment to advancing consumer privacy. The Board’s decision reflects a strategic effort to streamline and democratize privacy rights, making it clear that the CPPA’s overarching goal is to alleviate consumers from the burden of navigating a myriad of individualized requests to safeguard their personal information. As this proposal progresses through the legislative process, it carries the potential to set a precedent, encouraging other states to follow suit.

Footnotes

1. We are already seeing movement in Colorado as of December 13, 2023, as the Attorney General posted public comments it received regarding qualifying Universal Opt-Out Mechanisms (UOOMs) that Colorado consumers may use to opt-out of data sales and targeted advertising under the Colorado Privacy Act. We expect a natural progression to regulations shifting to browser vendors.

Disclaimer

This material is provided for informational purposes only. It is not intended to constitute legal advice nor does it create a client-lawyer relationship between Hall Booth Smith, P.C. and any recipient. Recipients should consult with counsel before taking any actions based on the information contained within this material. This material may be considered attorney advertising in some jurisdictions. Prior results do not guarantee a similar outcome.