AMENDED IN SENATE SEPTEMBER 5, 2025

AMENDED IN ASSEMBLY JUNE 2, 2025

AMENDED IN ASSEMBLY APRIL 8, 2025

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION

94

CHAPTER 465

Statutes of 2025

[ Approved by Governor October 8, 2025. Filed with Secretary of State October 8, 2025. ]

Introduced by Assembly Member Lowenthal

February 12, 2025

An act to add Section 1798.136 to the Civil Code, relating to privacy.

Vote: majority   Appropriation: no   Fiscal committee: yes   Local program: no

LEGISLATIVE COUNSEL’S DIGEST

The California Consumer Privacy Act of 2018 (CCPA) grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified. The California Privacy Rights Act of 2020, approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, amended, added to, and reenacted the CCPA and establishes the California Privacy Protection Agency and vests the agency with full administrative power, authority, and jurisdiction to enforce the CCPA.

This bill would, beginning January 1, 2027, prohibit a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed. The bill would require a business that develops or maintains a browser to make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the opt-out preference signal. The bill would grant a business that develops or maintains a browser that includes this functionality immunity from liability for a violation of those provisions by a business that receives the opt-out preference signal. The bill would authorize the agency to adopt regulations as necessary to implement and administer those provisions.

This bill would declare that its provisions further the purposes and intent of the California Privacy Rights Act of 2020.

The people of the State of California do enact as follows:

SECTION 1.

This act shall be known as the California Opt Me Out Act.

SEC. 2.

Section 1798.136 is added to the Civil Code, to read:

1798.136.

(a) (1) A business shall not develop or maintain a browser that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal to businesses with which the consumer interacts through the browser.

(2) The functionality required by paragraph (1) shall be easy for a reasonable person to locate and configure.

(b) A business that develops or maintains a browser shall make clear to a consumer in its public disclosures how the opt-out preference signal works and the intended effect of the opt-out preference signal.

(c) The California Privacy Protection Agency may adopt regulations as necessary to implement and administer this section.

(d) A business that develops or maintains a browser that includes a functionality that enables the browser to send an opt-out preference signal pursuant to this section shall not be liable for a violation of this title by a business that receives the opt-out preference signal.

(e) As used in this section:

(1) “Browser” means an interactive software application that is used by consumers to locate, access, and navigate internet websites.

(2) “Opt-out preference signal” means a signal that complies with this title and that communicates the consumer’s choice to opt out of the sale and sharing of the consumer’s personal information.

(f) This section shall become operative on January 1, 2027.

SEC. 3.

The Legislature finds and declares that this act furthers the purposes and intent of the California Privacy Rights Act of 2020.