New CA Law Mandates Support for Opt-Out Signals

It's been a long and challenging road, but California Governor Gavin Newsom signed AB 566 into law on October 8, 2025. The bill, which amends the California Consumer Privacy Act (CCPA), requires all web browsers to include an opt-out preference signal in their settings. This comes one year after Governor Newsom vetoed a similar bill.

The new law will take effect on January 1, 2027.

While the bill itself is short, AB 566 could have a dramatic effect on the privacy landscape.

What's Changing

Opt-out preference signals, sometimes called universal opt-out mechanisms, are a prominent feature of the CCPA, as well as many other U.S. state privacy laws. In theory, a consumer can enable the signal in their browser, and businesses must interpret the signal as an opt-out request. 

In response, web developers created the Global Privacy Control (GPC) standard, which offers a simple way to send and receive an opt-out preference signal. The problem was that only Mozilla Firefox and a few other privacy-focused browsers like Brave and DuckDuckGo offered native support for GPC. 

Google’s Chrome browser and Apple’s Safari account for roughly 80-85% of the browser market (throw in Microsoft Edge and it's closer to 90%). However, none of these systems offered native support for GPC or any other type of opt-out signal, and they had little reason to do so. The new law requires browsers to include an opt-out preference signal in their settings options, making it much easier for consumers to find and enable that setting.

Businesses should expect to see a massive increase in this type of opt-out once consumers have access to this tool.

Lingering Questions

While browser developers are required to include an opt-out preference signal, they are not required to adopt GPC as the standard. It will be interesting to see if they develop their own opt-out signals instead.

Another thing to watch is whether browser companies will try to geographically restrict the availability of the opt-out setting to the state of California. If so, we might expect to see copycat laws passed in other states that require the honoring of opt-out signals.

Getting Ready for AB 566

Processing opt-out signals has already been a requirement for years, but the requirement is about to take on a whole new level of importance. AB 566 will probably trigger a huge rise in automatic opt-outs. As seen in numerous recent enforcement cases, such as the $1.35M settlement with Tractor Supply Co., it's clear that the California Privacy Protection Agency considers this to be a key area of compliance.

Getting prepared means more than just dropping a snippet of code into your website. It means creating an internal data map, checking vendor documentation, and, perhaps most importantly, clearly understanding the exact practices that these opt-outs apply to. TrueVault guides businesses through the process with attorney-designed workflows, vendor automations, and expert human support. In as little as a few hours, you can get your business compliant with privacy laws from across the United States and more.

To get your business privacy compliant and painlessly integrate Global Privacy Control into your website, contact the TrueVault team.

‍