Surveys indicate that an overwhelming majority of Americans worry about how their personal data is collected and used. And CR’s own nationally representative surveys (PDF) show nearly half of Americans lack confidence that their personal data is private and not distributed without their knowledge. They’re right to feel this way: In most of the U.S., there are few specific limits on how much data companies can vacuum up about us, who they can share it with and sell it to, or what it can be used for. So companies gather vast amounts of data about each of us, which then gets used to pitch us products, hit us with political messages, set our auto insurance rates, and much more.
Consumers in many (but definitely not all) states already have the right to “opt out” of data sharing and sales, but it’s not easy to exercise those rights. You can try opting out one website at a time, but virtually nobody has the time to do that. Those who do try often have to jump through hoops at each website, either by filling out complicated opt-out forms or locating links buried deep in the legal fine print—and even then, opting out sometimes just doesn’t work. (CR’s free Permission Slip app can help you automate this process; see details, below.)
The CCPA tried to fix this for Californians by requiring websites to honor “universal opt-out signals” that automatically instruct every company you interact with on the web not to collect or share your data. But only a small number of internet browsers have universal opt-out signals built into them—the dominant ones owned by Apple (Safari) and Google (Chrome) do not. And most ordinary computer users aren’t up for the job of downloading third-party browser extension software that could help, such as Privacy Badger and DuckDuckGo Privacy Essentials.
The proposed law, known as AB-3048, would require all internet browsers and mobile operating systems (the software that runs phones and other devices) to enable users to send opt-out privacy signals to every website they visit, and to every app they use, with a one-time click of an easy-to-find checkbox or toggle switch.
“If this bill is signed into law, it’ll be a landmark moment for privacy rights,” says Matt Schwartz, a privacy policy analyst at Consumer Reports. “Making the universal opt-out a simple, easy-to-enable setting instantly gives millions of Californians real control over their privacy."
“Managing your privacy can seem scary,” says Hayley Tsukayama, associate director of legislative activism at the nonprofit Electronic Frontier Foundation. “Saying to these companies that they have to give people the option to set-it-and-forget-it is a very big deal.”
A group of technology, advertising, and other business coalitions led by the California Chamber of Commerce opposes the bill. They argue, among other things, that it would generate too many technical and compliance challenges for businesses.
CR’s Schwartz dismisses those concerns, noting that third-party browser extensions are already sending universal opt-out signals—and that businesses already have to honor universal opt-outs under California law (and will soon have to do so in at least 12 other states under recently passed laws).
“Browsers and mobile operating systems can easily add universal opt-out functionality to their products, they just don’t want to because they and their business partners profit from the surveillance economy,” he says. “Contrary to industry’s attempts to muddle things, A.B. 3048 is a simple bill with a simple premise: It should be easy to opt out.”
Governor Newsom has until September 30 to sign the legislation. If he does, the law will go into effect in January 2025.
In the meantime, or if you live in states other than California, here are some simple ways to limit how much personal data companies collect on you.
• Limit GPS tracking on your smartphone, by turning off location services either altogether or for any apps that don’t need it.
• Try to keep your apps from tracking your online activity—again, you can do this across all your apps at once or app-by-app.
• Use your browser’s privacy settings and consider switching to a more privacy-protective browser (such as Brave and Firefox) or using a privacy-protecting browser extension (such as Privacy Badger and DuckDuckGo Privacy Essentials).
• Use CR’s free Permission Slip app, which shows what kinds of information companies collect and lets you tell each company to stop selling your data or to delete it entirely.
• For step-by-step instructions on all of those measures, and a more thorough list of tips, check out these 30-second privacy fixes. For even more protection, try CR’s free Security Planner tool, which will make customized recommendations after you answer a few simple questions.