On October 8, 2025, Governor Newsom signed the California Opt Me Out Act (the “Act”) into law, which expands on the California Consumer Privacy Act (“CCPA”). Most notably, the Act mandates that businesses developing or maintaining internet browsers must include functionalities enabling consumers to automatically communicate their preference to opt out of the sharing or selling of personal information. The functionalities must be readily accessible to consumers and must be “easy for a reasonable person to locate and configure,” which will spare consumers from the hardships of navigating oftentimes confusing mechanics to identify and enable opt outs.
Looking ahead, while the Act is only tailored to apply to the parties that are developing or maintaining a browser, the CCPA currently arms consumers with the right to opt out of the selling or sharing of their personal information, and requires that parties subject to the CCPA honor opt outs that are communicated to them (in some cases, through browser-based signals). Incorporation of easy-to-use functionalities will likely increase the number of opt outs, which regulated parties will be required to honor.
The Act also sends a signal that California is taking additional steps to provide consumers with greater control over how their personal information is sold or shared by businesses and also serves a dual purpose of combatting dark patterns, particularly as it allows consumers to streamline the process of opting out.[1] As California continues to be a trailblazer in expanding consumer control around how their personal information is collected and used, other states will likely adopt similar approaches.
FOOTNOTES
[1] A “dark pattern” generally includes “a user interference designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking,” such as significant hurdles to opt out processes, adding items to shopping baskets without consent, among other activities. Cal. Civ. Code § 1798.140(l).