America will get new browser settings thanks to new law in California

from Colin LetcherCalMatters

This story was originally published by CalMatters. Sign up for their newsletters.

Privacy changes that web browsers will have to make under a new law in California could set the de facto standard for the entire country, changing how Americans control their data when they use the Internet, experts say.

Assembly Bill 566, recently signed by Gov. Gavin Newsom, requires companies that make web browsers to offer users an “opt-out signal” that automatically tells websites not to share or sell their personal information while they’re browsing.

“We expect it to have a national impact.”

Emory Roan, Privacy Rights Clearinghouse

It would probably be easier for companies to roll out the service to the entire country instead of just to users in California.

“It’s such a trivial enforcement,” said Emory Roan, associate director of policy at the Privacy Rights Clearinghouse, an organization that pushed for the legislation. “Technically it’s really not that hard.”

The legislation, the first of its kind in the country, was sponsored by the California Privacy Protection Agency, the state’s Consumer Privacy Protection Office, as well as several consumer protection and privacy groups.

Under the law, browsers like Google’s Chrome and Microsoft’s Edge will have until early 2027 to create a way for users to opt out of the signal. Combined with recent changes from other states, the new law could be a turning point in how web traffic is treated in the United States.

“We expect this to have a national impact,” Roan said.

National standard

California already offers privacy protections under the California Consumer Privacy Act, including a right to opt out of the sale of their information.

But supporters of the new law point out that it still puts the burden on the user to navigate to web pages and individually choose which web pages to opt out of. The new tool will effectively automate this process, giving users a single switch to keep their data secure.

“I would say that if you have to go to every single website and click on the link saying ‘you don’t want your information sold or shared,’ that’s not really a meaningful privacy right,” said Catriona Fitzgerald, deputy director of the Electronic Privacy Information Center, another organization that pushed for AB 566.

Already, some browser manufacturers have voluntarily offered similar settings under a framework called Global Privacy Control. Mozilla’s Firefox, for example, includes a setting called “tell websites not to sell or share your data.” With this setting turned on, the browser tells sites that the visitor wants the site to respect the user’s preferences.

Several states, including Texas and New Jersey, have transferred to forced companies to respect such preferences and the Attorney General of California has even taken legal action against firms that do not.

But until now, browsers weren’t required to offer a setting that used Global Privacy Control or another standard to communicate user preferences. “There are browser extensions, but they’re not very widely used,” said Nick Doty, senior technologist at the Center for Democracy and Technology.

Because it would likely be burdensome for companies to figure out a way to allow the signal to be used only by Californians, experts say the tool will likely be available nationwide. Exactly what that will look like remains to be seen. The legislation does not require browser manufacturers to use a specific standard. (Spokesmen for Google and Microsoft declined to comment on the companies’ plans.)

There is still a risk that some websites will try to detect which country the visitor is from and only honor the signal if they find that the visitor is from a country that requires it.

But that’s legally risky, according to Roan, who points out that AB 566 applies to California residents regardless of whether they use California’s network.

“If I can say I’m a local resident and you assume I’m not, and you clearly don’t respect my privacy wishes, that’s a violation of the law,” Roan said.

Pushback from Google and the industry

The law did not make it to the finish line without friction. like CalMatters reported in Septemberalthough not publicly opposed to the legislation, Google organized opposition to the bill through a group it financially supports.

Nor was AB 566 the first attempt at such legislation. Newsom vetoed a similar but slightly more expansive version of the bill in 2024.

But now that the door is open, some advocates say they will continue to push for further expansion of privacy preferences.

Roan notes that legislation could be drafted to require connected smart devices to offer opt-out or for vehicles that collect driver data to honor opt-out requests.

“We’re finally, finally starting to have real privacy rights,” Roan said, “but we’re a long way from them being really easy to exercise across the country and across the border and even in states like California where we have those rights.”

This article was originally published on CalMatters and is republished under Creative Commons Attribution-NonCommercial-No Derivatives license.