CPPA Sponsors Crucial Personal Information Protection Bill

SACRAMENTO — On Wednesday, February 12, 2025, Assemblymember Josh Lowenthal introduced Assembly Bill (AB) 566, sponsored by the California Privacy Protection Agency (CPPA). The bill requires browsers and mobile operating systems to give consumers a one-step option to limit the sharing of their information with opt-out preference signals.

“I firmly believe in the right to privacy and that our digital footprint, including our personal data, is our property and should be protected; that's why I'm carrying this bill. Many consumers are unaware of how their data is being collected and utilized when they are navigating the internet and the unintended use or misuse of our personal data remains far too common. AB 566 will ensure that an individual's right to privacy is upheld by requiring web browsers to offer global opt-out settings,” Lowenthal stated.

Many businesses collect and repurpose personal information through every interaction with consumers, and can use and share it in dangerous ways that consumers may not expect. It is vital for individuals to have meaningful control over sensitive information, including reproductive health, immigration status, financial condition, employment, political activity, military service, religion, and ethnic identity.

“It's never been more important for consumers to be able to easily limit the sale and sharing of their personal information,” said Maureen Mahoney, Deputy Director of Policy & Legislation at the CPPA. “We look forward to working with Assemblymember Lowenthal on this much-needed bill to ensure Californians have access to a simple tool they can use to protect their information.”

Businesses' misuse of data can be costly for consumers. For example, the Federal Trade Commission alleged in 2023 that the online prescription company GoodRx had been sharing users' prescription information with Facebook and Google. These details could be used to infer whether the consumer has a serious health condition, information about their reproductive health, and their sexual orientation, in addition to other sensitive information.

This bill also helps parents protect their children's data from misuse by easily enabling the right to opt-out of data sharing. This is critical because children are increasingly exposed to apps that misuse their data. For example, just last year, the California Attorney General and the Los Angeles City Attorney took action against Tilting Point Media for collecting and selling kids' information without consent through the “SpongeBob: Krusty Cook-Off” app.

The California Consumer Privacy Act (CCPA) already gives California consumers the right to stop the sale and sharing of their personal information through opt-out signals. This bill simplifies the process by requiring that all browsers support opt-out preference signals, allowing users to protect their privacy in a single step. When enabled, it automatically sends a signal from the browser to any websites visited, indicating the user's opt-out request. Without these signals, consumers would have to submit individual requests at each business with which they interact, which is incredibly time-consuming and burdensome.

Several privacy-focused browsers like Brave, DuckDuckGo, and Mozilla Firefox, already offer native support for these signals. However, Google Chrome, Microsoft Edge, and Apple Safari, which make up 90% of the desktop browser market, have declined to do so.

The bill would also eventually extend the signal requirement to mobile operating systems, which is how many consumers access the internet, allowing them to easily opt out of the sale and sharing of information by all apps in a single request.

Currently, a dozen states, including California, require businesses to honor browser privacy signals as an opt-out of sale of their personal information. If passed, California would become the first state to mandate browser support for privacy signals, setting a powerful precedent for protecting consumer privacy nationwide.

About Us

The California Privacy Protection Agency is committed to rulemaking, enforcement, and public awareness of consumers' privacy rights and businesses' responsibilities under the California Consumer Privacy Act. Individuals can visit privacy.ca.gov to access helpful and up-to-date information on how to exercise their rights and protect their personal information. In addition, the Agency's website provides important information about CPPA board meetings, announcements, and the rulemaking process.

Contact: press@cppa.ca.gov