CPPA Board Approves Legislative Proposal to Require Browsers to Offer Opt-out Preference Signals

The California Privacy Protection Agency Board voted 5-0 at its December 8, 2023 meeting to advance a legislative proposal to require browser vendors to include a feature that allows users to exercise their California privacy rights through opt-out preference signals.

“We applaud the Board for their leadership in advancing this innovative proposal, which sits at the cutting edge of technology policy,” said Ashkan Soltani, Executive Director of the California Privacy Protection Agency. “If approved through the California legislative process, this proposal will not only advance Californians’ consumer privacy, but help incentivize the development of privacy-enhancing technologies.”

Under the California Consumer Privacy Act (CCPA), businesses are required to honor opt-out preference signals as a request to opt-out of sale/sharing. These signals are a simple and easy-to-use method by which consumers interacting with businesses online can automatically exercise their right to opt-out of sale/sharing. Through an opt-out preference signal, a consumer can opt-out of sale and sharing of their personal information with all businesses they interact with online without having to make individualized requests with each business.

“Opt-out preference signals are a powerful tool to help consumers protect their privacy rights,” said Maureen Mahoney, Deputy Director of Policy and Legislation at the Agency. “Consumers shouldn’t have to submit individual requests at hundreds of sites just to protect their personal information. We look forward to working with California legislators to make it easier for California consumers to exercise their privacy rights.”

Currently, to exercise this right under California law, consumers must either use a browser that supports an opt-out preference signal or take extra steps to find and download a browser plugin created by third-party developers that adds support for such signals. To date, only a limited number of browsers offer native support for opt-out preference signals: Mozilla Firefox, DuckDuckGo, and Brave. Together, they make up less than 10% of the overall global desktop browser market share. Importantly, none are loaded onto devices by default, making it difficult for consumers to learn about and take advantage of these protections.

Google Chrome, Microsoft Edge, and Apple Safari—which make up over 90% of the desktop browser market share—have declined to offer these signals, although these companies are also heavily reliant on advertising business models. No device operating system has yet implemented support for opt-out preference signals.

If the proposal is adopted, California would be the first state to require browser vendors to offer consumers the option to enable these signals. Seven states, including California, Colorado, Connecticut, Delaware, Montana, Oregon, and Texas, require businesses to honor browser privacy signals as an opt out of the sale of personal data.

Contact: press@cppa.ca.gov