| Old | New | Differences | |
|---|---|---|---|
| 1 | - | ||
| 1 | + | CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 566Introduced by Assembly Member LowenthalFebruary 12, 2025 An act to add Section 1798.136 to the Civil Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTAB 566, as introduced, Lowenthal. California Consumer Privacy Act of 2018: opt-out preference signal.The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO Bill TextThe people of the State of California do enact as follows:SECTION 1. Section 1798.136 is added to the Civil Code, to read:1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information.SEC. 2. The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020. | |
| 2 | 2 | ||
| 3 | - | ||
| 3 | + | CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION Assembly Bill No. 566Introduced by Assembly Member LowenthalFebruary 12, 2025 An act to add Section 1798.136 to the Civil Code, relating to privacy.LEGISLATIVE COUNSEL'S DIGESTAB 566, as introduced, Lowenthal. California Consumer Privacy Act of 2018: opt-out preference signal.The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.Digest Key Vote: MAJORITY Appropriation: NO Fiscal Committee: YES Local Program: NO | |
| 4 | 4 | ||
| 5 | - | Amended IN Assembly April 08, 2025 | |
| 6 | 5 | ||
| 7 | - | Amended IN Assembly April 08, 2025 | |
| 6 | + | ||
| 7 | + | ||
| 8 | 8 | ||
| 9 | 9 | CALIFORNIA LEGISLATURE 20252026 REGULAR SESSION | |
| 10 | 10 | ||
| 11 | 11 | Assembly Bill | |
| 12 | 12 | ||
| 13 | 13 | No. 566 | |
| 14 | 14 | ||
| 15 | 15 | Introduced by Assembly Member LowenthalFebruary 12, 2025 | |
| 16 | 16 | ||
| 17 | 17 | Introduced by Assembly Member Lowenthal | |
| 18 | 18 | February 12, 2025 | |
| 19 | 19 | ||
| 20 | 20 | An act to add Section 1798.136 to the Civil Code, relating to privacy. | |
| 21 | 21 | ||
| 22 | 22 | LEGISLATIVE COUNSEL'S DIGEST | |
| 23 | 23 | ||
| 24 | 24 | ## LEGISLATIVE COUNSEL'S DIGEST | |
| 25 | 25 | ||
| 26 | - | AB 566, as | |
| 26 | + | AB 566, as introduced, Lowenthal. California Consumer Privacy Act of 2018: opt-out preference signal. | |
| 27 | 27 | ||
| 28 | - | The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. | |
| 28 | + | The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. | |
| 29 | 29 | ||
| 30 | 30 | The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumers personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA. | |
| 31 | 31 | ||
| 32 | - | This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. | |
| 32 | + | This bill would prohibit a business from developing or maintaining a browser that does not include a setting that enables a consumer to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser and would, 6 months after the adoption of certain regulations by the agency, prohibit a business from developing or maintaining a mobile operating system, as defined, that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions, including to update the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. | |
| 33 | 33 | ||
| 34 | 34 | This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020. | |
| 35 | 35 | ||
| 36 | 36 | ## Digest Key | |
| 37 | 37 | ||
| 38 | 38 | ## Bill Text | |
| 39 | 39 | ||
| 40 | - | The people of the State of California do enact as follows:SECTION 1. Section 1798.136 is added to the Civil Code, to read:1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 40 | + | The people of the State of California do enact as follows:SECTION 1. Section 1798.136 is added to the Civil Code, to read:1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information.SEC. 2. The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020. | |
| 41 | 41 | ||
| 42 | 42 | The people of the State of California do enact as follows: | |
| 43 | 43 | ||
| 44 | 44 | ## The people of the State of California do enact as follows: | |
| 45 | 45 | ||
| 46 | - | SECTION 1. Section 1798.136 is added to the Civil Code, to read:1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 46 | + | SECTION 1. Section 1798.136 is added to the Civil Code, to read:1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information. | |
| 47 | 47 | ||
| 48 | 48 | SECTION 1. Section 1798.136 is added to the Civil Code, to read: | |
| 49 | 49 | ||
| 50 | 50 | ### SECTION 1. | |
| 51 | 51 | ||
| 52 | - | 1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 52 | + | 1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information. | |
| 53 | 53 | ||
| 54 | - | 1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 54 | + | 1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information. | |
| 55 | 55 | ||
| 56 | - | 1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 56 | + | 1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser.(2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure.(b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system.(2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system.(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns.(d) As used in this section:(1) Browser means an interactive software application that is primarily used by consumers to access internet websites.(2) Mobile operating system means an operating system in use on a smartphone or tablet.(3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information. | |
| 57 | 57 | ||
| 58 | 58 | ||
| 59 | 59 | ||
| 60 | - | 1798.136. (a) (1) Unless otherwise prohibited by federal law, | |
| 60 | + | 1798.136. (a) (1) Unless otherwise prohibited by federal law, a business shall not develop or maintain a browser that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the browser. | |
| 61 | 61 | ||
| 62 | 62 | (2) The setting required by paragraph (1) shall be easy for a reasonable person to locate and configure. | |
| 63 | 63 | ||
| 64 | 64 | (b) (1) A business shall not develop or maintain a mobile operating system that does not include a setting that enables a consumer to send an opt-out preference signal to businesses with which the consumer interacts through the mobile operating system. | |
| 65 | 65 | ||
| 66 | 66 | (2) This subdivision shall become operative six months after the adoption of regulations by the California Privacy Protection Agency that outline the requirements and technical specifications for an opt-out preference signal to be used by a mobile operating system. | |
| 67 | 67 | ||
| 68 | - | (c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. | |
| 68 | + | (c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section, including, but not limited to, ensuring that the setting described by subdivision (a) is easy for a reasonable person to locate and configure and updating the definitions of browser and mobile operating system to address changes in technology, data collection, obstacles to implementation, or privacy concerns. | |
| 69 | 69 | ||
| 70 | 70 | (d) As used in this section: | |
| 71 | 71 | ||
| 72 | 72 | (1) Browser means an interactive software application that is primarily used by consumers to access internet websites. | |
| 73 | 73 | ||
| 74 | 74 | (2) Mobile operating system means an operating system in use on a smartphone or tablet. | |
| 75 | 75 | ||
| 76 | 76 | (3) Opt-out preference signal means a signal that complies with this title and that communicates the consumers choice to opt out of the sale and sharing of the consumers personal information. | |
| 77 | 77 | ||
| 78 | 78 | SEC. 2. The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020. | |
| 79 | 79 | ||
| 80 | 80 | SEC. 2. The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020. | |
| 81 | 81 | ||
| 82 | 82 | SEC. 2. The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020. | |
| 83 | 83 | ||
| 84 | 84 | ### SEC. 2. |