One click in California, and companies can’t sell your personal data

Data privacy in California will soon be easy with just the click of a button. Gov. Gavin Newsom on Wednesday signed a bill that would require Internet browsers to make it easier for customers to notify websites that they don’t want their data sold.

---

Don’t miss any of our unbiased technical content and lab reviews. Add CNET As Google’s preferred source.

---

The bill is called California Opt-Out Lawand enhances California Consumer Privacy Actwhich became law in 2020. The law originally allowed internet consumers to opt out of the sale of their data to third parties, but major web browsers have not made this process simple. Consumers would either have to install third-party browser extensions or instruct every website they visited not to sell their data.

More from CNET: Are you concerned about the security of your data and privacy? You are not alone

Tom Kemp, executive director of the California Privacy Agency, said Internet users should not have to…Jump through countless hoops“To prevent their data from being sold.

“This law puts power back in the hands of consumers and makes exercising your broad privacy rights as simple as clicking a button on your browser,” Kemp said in a statement.

Staff for California Assemblyman Josh Lowenthal (D-Long Beach) said the law affects browsers on both desktop and mobile and applies to California residents who use a browser that meets certain threshold requirements, such as revenue and the number of consumers whose data is shared.

“A big step forward”

Debbie ReynoldsCalifornia’s new law represents a big win for consumers but that enforcement will be key, said a data privacy expert and emerging technology strategist known as The Data Diva.

“It shifts control of privacy from individual users to companies that have the resources and technology to manage it effectively,” Reynolds told CNET. “The new requirement will force companies to redesign their data systems, which were never designed to manage a global opt-out signal. While the change improves privacy for consumers, consistent implementation and adoption across all platforms will be essential to complete protections.”

Reynolds, who served on the Commerce Department’s advisory board and was also named one of the Top 20 Women in Legal Tech by the American Bar Association, told CNET that other states are likely to follow California’s lead.

“California has influenced privacy standards in the United States for decades, and when California raises the bar, other states tend to follow suit,” Reynolds said.

Unsubscribing just got easier

The new law, which takes effect in January 2027, requires web browsers — such as California-based Google Chrome and Apple Safari — to make it easier for consumers to notify websites that they don’t want their data sold.

The law states that web browsers must include “consumer-configurable functionality,” and that functionality must be “easy for a reasonable person to locate and configure.” The law states that browsers have flexibility in how they provide an opt-out tool.

Firefox, for example, offers Global Privacy Monitor Signal, which consumers can enable in Settings or using Firefox’s private browsing mode.

By clicking or tapping a button, users send a signal — known as opt-out preference signals, or OOPS — to commercial websites. These signals let these merchants know whether or not they can sell your data. This can include your browsing history, location data, purchase history, and personal interests.

Reynolds said it’s essential that consumers take advantage of simplified data privacy opt-outs.

“When people do not opt ​​out, their personal information can be sold or shared with companies they have not directly interacted with before,” Reynolds said. “Once sold, this data can be combined with other information to create detailed profiles that influence what users see online, how they are targeted with ads and even what offers they receive for credit or insurance. Many people are skipping the opt-out option now because the process is too time-consuming and confusing.”

California is One of 12 states in the United States Which requires companies to respect consumers’ data privacy requests.