This story was originally published by CalMatters. Sign up for their newsletters.

The privacy changes web browsers will be required to make under a new California law could set the de facto standard for the entire country, changing how Americans control their data when using the internet, according to experts.

Assembly Bill 566, recently signed into law by Gov. Gavin Newsom, requires companies that make web browsers to offer users an opt-out “signal” that automatically tells websites not to share or sell their personal information as they browse.

It will likely be easier for companies to roll out the service for the entire country, rather than for users only in California.

“It’s such a trivial implementation,” said Emory Roane, associate director of policy at Privacy Rights Clearinghouse, an organization that pushed for the legislation. “It’s really not that difficult technically.”

The legislation, a first of its kind in the country, was sponsored by the California Privacy Protection Agency, the state’s consumer privacy watchdog, as well as several consumer advocacy and privacy rights groups.

Under the law, browsers like Google’s Chrome and Microsoft’s Edge will have until the beginning of 2027 to create a way for consumers to select the signal. Combined with recent changes from other states, the new law could be a tipping point in how web traffic is treated in the United States.

“We expect it to have a national impact,” Roane said.

A national standard

California already offers privacy protections under the California Consumer Privacy Act, including a right to opt out from having their information sold.

But advocates for the new law point out this still puts the burden on the consumer to navigate to web pages and individually select web pages to opt out from. The new tool will effectively automate that process, giving consumers a single toggle to keep their data protected.

“I would argue if you have to go to every individual website and click the link saying you ‘don’t want your information sold or shared,’ that’s not really a meaningful privacy right,” said Caitriona Fitzgerald, deputy director of the Electronic Privacy Information Center, another organization that pressed for AB 566.

Already, some browser makers have voluntarily offered similar settings under a framework called the Global Privacy Control. Mozilla’s Firefox, for example, includes a setting called “tell websites not to sell or share your data.” With that setting on, the browser communicates to sites that the visitor wants the site to respect the user’s preference.

Several states, including Texas and New Jersey, have moved to force companies to respect such preferences, and California’s attorney general has even taken legal action against businesses that fail to do so.

But until now, browsers haven’t been required to offer a setting that uses the Global Privacy Control or another standard to communicate users’ preferences. “There are browser extensions but those aren’t very widely used,” said Nick Doty, senior technologist at the Center for Democracy and Technology.

Since it would likely be burdensome for companies to carve out a way to only allow the signal to be used by Californians, according to experts, the tool will likely be available across the country. How, exactly, that will look still remains to be seen. The legislation doesn’t require browser makers to use a specific standard. (Spokespeople for Google and Microsoft declined to comment on the companies’ plans.)

There’s still a risk that some websites may try to detect which state a visitor is from, and only respect the signal if they find the visitor is from a state that mandates it.

This is legally risky, though, according to Roane, who points out that AB 566 applies to residents of California, regardless of whether they’re using the web from California.

“If I’m safe saying I’m a resident and you’re assuming I’m not and you’re flagrantly not respecting my privacy wishes, that is a violation of the law,” Roane said.

Pushback from Google and the industry

The law didn’t get across the finish line without friction. As CalMatters reported in September, despite not being publicly against the legislation, Google organized opposition to the bill through a group it backs financially.

AB 566 also wasn’t the first attempt at such legislation. Newsom vetoed a similar, but slightly more expansive, version of the bill in 2024.

But now that the door is open, some advocates say they are going to continue to push to further expand privacy preferences.

Roane notes that legislation could be drafted that requires connected smart devices to offer an opt-out preference, or for vehicles that gather data on drivers to respect opt-out preference requests.

“We are  finally, finally starting to have real privacy rights,” Roane said, “but we’re far away from them being really easy to exercise across the country and across the border and even in states like California where we have these rights.”