The talk of “opt-out preference signals” or global privacy controls (GPC) has been increasing as companies dig into the forthcoming requirements under US “comprehensive” privacy laws. What is an opt-out preference signal? An “opt-out preference signal” also known colloquially as ”GPC,” is a signal sent by a platform or technology on behalf of a consumer that communicates the consumer’s choice to opt out of sale or sharing. Below, we summarize how each of the states treats this requirement.
- California. While the current version of CCPA does not statutorily require business to recognize opt-out preference signals, the regulations do contemplate such a thing. The current regulations state that companies must honor GPC as a valid opt-out request. However, CPRA (which amends CCPA and comes into effect January 1, 2023) does address GPC in the statute and more specifically in the regulations. Under the current draft version of the regulations, even where a business posts a “Do Not Sell My Personal Information” link, it must still process opt-out preference signals. 11 CCR 7025(e). The regulations should be consulted for more specifics around the requirements for implementing this mechanism.
- Colorado. Colorado’s law similarly contemplates a universal opt-out mechanism. From July 1, 2023 (when the law goes into effect), until July 1, 2024, companies may, but are not required to, recognize the mechanism as a way for consumers to opt out of targeted advertising or sales. By July 1, 2024, companies will be required to honor this mechanism. Part 5 of the recently published regulations provide more technical details about implementing this requirement.
- Connecticut. There is also universal opt-out mechanism requirement in Connecticut’s law. This law, which goes into effect July 1, 2023, allows companies to delay compliance with the opt-out mechanism obligations until January 1, 2025. By that date, companies will need to allow consumers to opt out of targeted advertising or sales of their data via the mechanism. Interestingly, the statute says that the mechanism should be as consistent as possible with any other similar platform, technology or mechanism required by any federal or state law or regulation.” The requirements in Connecticut for this obligation are otherwise brief compared what is outlined in California and Colorado’s regulations.
- Utah and Virginia. The current draft of these states do not seem to contemplate any obligation to honor a universal opt-out mechanism or signal. That said, presumably both laws could be amended to add such a requirement in the future.
Putting it into practice. As companies look to third party tools and technologies to implement the opt-out mechanism requirement, California and Colorado’s obligations should be closely reviewed. The earliest timeline for implementing will be for California consumers (January 1, 2023). Given that regulations are not currently contemplated in Connecticut, companies may choose to look to California and Colorado for guidance on how to implement this obligation there.