If a user sets a privacy preference, an operating system or app cannot change that setting without the user’s explicit consent, says new bill, AB 2561, that passed the California legislature.
A “Privacy setting” means any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.
What does this change for processing personal information of Californians?
Under longstanding FTC enforcement, retroactive changes to privacy practices have often required consent where they would result in a more permissive use or disclosure of previously collected personal information.
Similarly, the CCPA and its implementing regulations restrict businesses from using personal information for materially different purposes than those disclosed at collection without first obtaining consent.
This law, if signed, would make this (1) expressly required by statute and (2) applicable regardless of whether the change would otherwise be considered material.
An exception to this would be if changing the setting is required by state or federal law, court order, or in response to a subpoena in an individual case or proceeding.
Businesses are also allowed to discontinue services or applications, cease the collection, use, retention, or sharing of a user’s personal information, or cease to offer privacy options, provided that such changes are either compliant with the law (required by law or in response to a subpoena), or the changes result in either of the following:
(2) An increase in privacy protection by reducing the collection, use, sharing, or retention of personal information.