• by Wendy Davis  @wendyndavis, February 28, 2024

A California state lawmaker has introduced a bill that would require browser developers to offer a tool that would easily allow consumers to opt out of online behavioral advertising throughout the web.

Assembly Bill 3048, quietly unveiled earlier this month by California Assemblymember Josh Lowenthal (D-69th District), would prohibit businesses from “developing or maintaining” web browsers that lack an opt-out preference setting. The best known current opt-out preference signal is the Global Privacy Control -- a mechanism created by privacy advocates to enable consumers to reject all sharing of online data for ad purposes.

That type of setting automatically conveys an opt-out request to every site a user visits. Without such a setting, consumers who want to reject behaviorally targeted ads can click on individual companies' opt-out links one-by-one, or can use a tool created by an ad industry organization to opt out of behavioral targeting by a broader range of companies.

In December, California's privacy agency called for legislation mandating that browser developers offer a tool like the Global Privacy Control.

Ashkan Soltani, executive director of the state's privacy agency, praised Lowenthal's bill.

“All Californians have the right to object to the sale and sharing of their personal information via opt-out preference signals, but most Californians are unable to avail themselves of these important rights because the tools they use to navigate online do not communicate their privacy preferences,” Soltani stated earlier this week. “It’s high time these vendors let consumers take full advantage of their rights.”

California's privacy law gives consumers the right to reject “cross-context” behavioral advertising -- meaning ads served based on activity across different sites. That law has been interpreted as requiring companies to honor opt-out requests that consumers transmit through browser-based tools -- referred to in state regulations as opt-out preference signals.

Other states including Colorado, Connecticut, Delaware, Montana and Texas have recently passed laws or regulations requiring companies to honor universal opt-out mechanisms.

Some developers, including Mozilla, Brave and Duck Duck Go have already built the Global Privacy Control into their browsers.

Apple used to include a “do-not-track” setting in Safari, but disabled the setting in 2019 due to concerns that ad-tech companies would harness the signal for device fingerprinting -- a tracking technique that identifies users based on characteristics of their browsers.

Google's Chrome doesn't include the specific “Global Privacy Control” setting, but has long had a “do-not-track” setting, which sends a no-tracking request to all websites consumers visit.

The California privacy agency has suggested that this older “do-not-track” command isn't equivalent to an "opt-out preference signal," but it's not clear whether other state officials will agree -- or whether Google could tweak the do-not-track command so that it could serve as an opt-out preference signal.