Data privacy in California will soon be as easy as clicking a button. Gov. Gavin Newsom on Wednesday signed into law a bill that requires internet browsers to make it easy for customers to notify websites that they do not want their data sold.
Don't miss any of our unbiased tech content and lab-based reviews. Add CNET as a preferred Google source.
The bill is called the California Opt Me Out Act, and it bolsters the California Consumer Privacy Act, which became law in 2020. The act originally allowed internet consumers to opt out of having their data sold to third parties, but major web browsers did not make that process simple. Consumers would either have to install third-party browser extensions or else instruct every single website they visited not to sell their data.
More from CNET: Worried About Your Data Security and Privacy? You're Not Alone
Tom Kemp, executive director of the California Privacy Protection Agency, said that internet consumers shouldn't have to "jump through countless hoops" to prevent their data from being sold.
"This law puts the power back in consumers' hands and makes exercising your privacy rights at scale as simple as clicking a button in your browser," Kemp said in a statement.
Staffers for California Assemblymember Josh Lowenthal (D–Long Beach) said that the law affects browsers on both desktop and mobile and applies to California residents using a browser that meets certain threshold requirements, such as revenue and how many consumers whose data are being shared.
'A major step forward'
Debbie Reynolds, data privacy and emerging technology strategist who's known as The Data Diva, said California's new law is a big win for consumers but that enforcement will be key.
"It moves privacy control from individual users to companies that have the resources and technology to manage it effectively," Reynolds told CNET. "The new requirement will force companies to redesign their data systems, which were never built to manage a universal opt-out signal. While the change improves privacy for consumers, consistent enforcement and adoption across all platforms will be essential to make the protection complete."
Reynolds, who served on a Department of Commerce advisory board and was also named one of the top 20 women in legal tech by the American Bar Association, told CNET it's likely other states will follow California's lead.
"California has influenced privacy standards in the United States for decades, and when California raises the bar, other states tend to follow," Reynolds said.
Opting out made easier
The new law, which takes effect in January 2027, requires that web browsers -- such as California-based Google Chrome and Apple Safari -- make it simple for consumers to notify websites that they don't want their data sold.
The law states that web browsers must include "functionality configurable by a consumer," and that functionality must be "easy for a reasonable person to locate and configure." The law says that browsers have flexibility in how they provide the opt-out tool.
Firefox, for example, offers a Global Privacy Control signal, which consumers can enable in settings or by using Firefox's private browsing mode.
By tapping or clicking on a button, users send a signal -- known as opt-out preference signals, or OOPS -- to business websites. Those signals let those merchants know whether or not they can sell your data. That could include browsing history, location data, purchase history and personal interests.
Reynolds said it's vital that consumers take advantage of streamlined data privacy opt-out processes.
"When people do not opt out, their personal information can be sold or shared with companies they have never interacted with directly," Reynolds said. "Once sold, that data can be combined with other information to build detailed profiles that influence what users see online, how they are targeted with advertising and even the offers they receive for credit or insurance. Many people skip opting out now because the process is time-consuming and confusing."
California is one of 12 states in the US that require businesses to honor the data privacy requests of consumers.
English (US) ·