California Passes Two Laws Expanding Opt-Out Signals

Want to receive these privacy recaps that matter to consent management, adtech and martech in your inbox? Sign up for our privacy newsletter, A Little Privacy, Please.

USA

California Passes Two Laws Expanding Opt-Out Signals

Just before the close of the California legislative session, two notable privacy bills were passed and sent to the governor, both impacting opt-out signals:

AB 3048 mandates that all browsers enable the setting of opt-out preference signals by January 1, 2026 and that mobile operating systems enable such settings within 6 months after the setting of applicable regulations by the California Privacy Protection Agency (CPPA). In both cases, the setting must communicate the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information or to limit the use of the consumer’s sensitive personal information, and it must be easy for a reasonable person to locate and configure, as further defined by the CPPA regulations.

AB 1949 amends the California Consumer Privacy Act of 2020 (CCPA) to raise the age of children’s privacy protections under the law from age 16 to age 18, including by requiring affirmative authorization for the sale or sharing of consumer information and requiring businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. The law requires the Attorney General to adopt regulations to establish technical specifications for an opt-out preference signal allowing a consumer or the consumer’s parent or guardian to specify the age of the consumer.

TAKEAWAY

These laws, in combination, expand the reach and scope of technical opt-out signals that businesses must listen for and respond to by expanding the availability of opt-out preference signal settings to consumers across all browsers and operating systems and expanding the signals that can be sent to include opt outs of sensitive personal information and age signals. This will likely result in an increase in both the frequency and type of opt-out signals companies must be prepared to respond to.

Sourcepoint is able to assist you with your CCPA compliance. Learn how, and more about CCPA, the California Consumer Privacy Act, that was amended.

CalIFORNIA Age Appropriate Design Code Enforcement Stayed Until March

Despite the 9th Circuit’s recent decision vacating in part the preliminary injunction barring enforcement of the California Age Appropriate Design Code Act, California has agreed in a joint stipulation to stay enforcement of the provisions no longer subject to an injunction until March 6, 2025 and to not seek to enforce the law retroactively against violations occurring before March 6, 2025. 

TAKEAWAY

This decision theoretically gives services likely to be accessed by children under the age of 18 six months to determine whether and how to implement measures to comply with the law, including (if applicable) measures to estimate the age of users with a “reasonable level of certainly” or to apply child-appropriate protections for all users. However, the case challenging the constitutionality of the law is still pending, putting companies in limbo until the case is resolved. The parties to the case are requesting that oral arguments be scheduled in January 2025, so by the time companies know for sure whether and to what extent they have to comply, their window to implement a solution may be extremely narrow or non-existent.

Download Sourcepoint’s sensitive data guide to learn how different states define sensitive information, understand enforcement mechanisms, and discover best practices for processing sensitive data.

Want more of the privacy highlights that matter for consent management, adtech and martech? Sign up for our privacy newsletter, A Little Privacy, Please.

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.