The California Opt Me Out Act (AB 566) requires any business covered by the California Consumer Privacy Act that develops or maintains a web browser to give users a setting that sends an opt-out preference signal, from 1 January 2027. Governor Newsom signed it on 8 October 2025. Websites already have to honour that signal under the CCPA. What changes is how many visitors will send it.
AB 566 is the first law to require an opt-out setting in browsers
The act amends the California Consumer Privacy Act (CCPA) with a new Civil Code section 1798.136. According to the California Privacy Protection Agency's announcement, it makes California the first state to require browsers to offer a built-in way to tell websites not to sell or share personal information.
From 1 January 2027, a business may not develop or maintain a browser that lacks this setting. The setting must be easy for a reasonable person to find and configure. Websites that collect data from California residents must then honour the signal by stopping the sale or sharing of personal information, as they already must today.
The practical effect is significant. Today, only a handful of browsers and extensions support Global Privacy Control (GPC): Brave and DuckDuckGo send it by default, and Firefox offers it in its settings, according to the GPC project. Once AB 566 takes effect, the large browsers made by businesses covered by the CCPA will need a setting of their own.
How opt-out signals became the default expectation in California
Browsers send the signal, websites act on it
The law creates two distinct obligations split between browser vendors and website operators.
Browser vendors must build an opt-out preference signal setting into their products and explain in their public disclosures how the signal works and what it is meant to do. The text of AB 566 lets the California Privacy Protection Agency (CPPA) adopt regulations to implement it. A browser maker that includes the setting is not liable for a website that ignores the signal.
Website operators carry the burden of recognising and processing the signal. If your site receives an opt-out preference signal from a visitor's browser, you must treat it as a valid request to stop selling or sharing that person's personal information, including for cross-context behavioural advertising.
GPC today compared with AB 566 from 2027
Global Privacy Control already functions as a recognised opt-out mechanism in multiple US states. CCPA opt-out requirements already oblige businesses to honour GPC signals. The difference AB 566 makes is on the supply side: it requires browsers to offer the signal, rather than leaving it to privacy-focused browsers and third-party extensions.
When the setting sits inside the browsers most people already use, the signal stops being a niche choice. How many visitors turn it on will depend on how prominently each browser presents the setting, which the law leaves open beyond "easy for a reasonable person to locate and configure".
| Factor | Before AB 566 | From 1 January 2027 |
|---|---|---|
| Browsers with a built-in opt-out signal | Brave and DuckDuckGo (on by default), Firefox (in settings) | Every browser developed or maintained by a business covered by the CCPA |
| User action required | Install an extension or switch browser | Turn on a setting in the browser |
| Legal basis | CCPA and its regulations require websites to honour the signal | The same, plus Civil Code section 1798.136 for browsers |
| Enforcement | California Attorney General, CPPA | California Attorney General, CPPA |
Which businesses are affected
On the website side, AB 566 changes nothing about who must comply. If your business is subject to the CCPA and sells or shares personal information of California residents, you must honour opt-out preference signals. The CCPA thresholds are annual gross revenue over $26,625,000 (adjusted on 1 January 2025), buying, selling or sharing the personal information of 100,000 or more consumers or households, or deriving 50% or more of revenue from selling or sharing personal information.
The shift is in how many consumers will be sending the signal. A site that sees GPC from a small share of its California traffic today should plan for that share to grow, without assuming a figure: no public data yet shows how browsers will present the setting.
That change hits advertising-dependent businesses hardest. Retargeting, cross-site tracking, and behavioural advertising all depend on the sale or sharing of personal data that opt-out signals are designed to stop.
Enforcement is already happening
California regulators have not waited for AB 566 to enforce opt-out signals. In September 2025, the CPPA fined Tractor Supply $1.35 million, in part for failing to honour opt-out preference signals such as GPC. The Attorney General's $2.75 million settlement with Disney in February 2026 cited GPC requests that Disney applied only to the device in use. In March 2026, the CPPA fined PlayOn Sports $1.1 million, partly for failing to recognise opt-out preference signals, and Ford $375,703 for requiring an email check before an opt-out.
As of October 2026, the CCPA penalties framework allows fines of up to $2,663 per violation and $7,988 per intentional violation (set from 1 January 2025), and each ignored signal from each consumer can count as a separate violation.
A joint investigative sweep announced on 9 September 2025 by the CPPA and the Attorneys General of California, Colorado and Connecticut targeted businesses that fail to honour GPC. Colorado and Connecticut both require recognition of universal opt-out mechanisms, making GPC failures a multi-state risk.
Other states and federal pressure
As of October 2026, 11 US states require businesses to recognise opt-out preference signals: California, Colorado, Connecticut, Montana, Nebraska, New Hampshire, New Jersey, Minnesota, Delaware, Oregon, and Texas, and Maryland lists the signal as one permitted way to offer the opt-out. The growing patchwork of US state privacy laws means that honouring GPC is no longer a California-only concern, and the global privacy laws overview shows where opt-in rules apply instead.
AB 566 is unusual because it targets browser vendors rather than only website operators. If the large browsers add an opt-out setting to satisfy California law, the setting may well be available to users everywhere, since building a California-only version adds work. Whether vendors do that is their choice: the law only covers California.
Federal privacy legislation has stalled repeatedly. In April 2026, the CPPA opposed the federal SECURE Data Act (H.R. 8413), which the agency says would pre-empt state laws and end the requirement to honour opt-out preference signals.
Preparing your website before January 2027
Start by checking whether your site already detects and honours GPC. The signal arrives as an HTTP header (Sec-GPC: 1) and a JavaScript property (navigator.globalPrivacyControl). If your site ignores both, you have work to do.
Your technical implementation of GPC should stop the sale and sharing of personal information when the signal is present. That means blocking marketing pixels, disabling cross-site tracking cookies like _fbp and _gcl_au, and making sure your Google Consent Mode configuration sends ad_storage and ad_personalization as denied.
A practical checklist:
- Detect
Sec-GPC: 1on the server side andnavigator.globalPrivacyControlon the client side - Map the signal to your consent management platform so it triggers the same behaviour as a manual opt-out
- Block marketing cookies and tracking scripts when the signal is active
- Check how Google Analytics 4 behaves with ad signals denied
- Audit third-party scripts so none keep sharing data after receiving the signal
- Show visitors that their opt-out signal was processed, which the CCPA regulations require from 1 January 2026
- Document your GPC handling process for regulatory enquiries
Impact on consent rates and analytics
The most immediate business impact will be a smaller pool of California visitors whose data can be sold or shared. As more of your California traffic sends an opt-out signal, your retargeting audiences shrink, your attribution models lose coverage, and marketing measurement becomes less precise.
This is not entirely new territory. European websites operating under the GDPR have dealt with high refusal rates for years. The strategies that work in Europe, such as server-side tagging, first-party data collection, and conversion modelling, will become equally relevant for California-focused campaigns.
Cookie consent banners do not disappear because of AB 566. The law addresses the sale and sharing of personal information, but GPC does not replace consent banners required under other frameworks. If your site serves visitors in the EU, you still need an opt-in banner that meets the GDPR consent standard. AB 566 adds a layer on top of existing requirements rather than replacing them.
Questions about the Opt Me Out Act
Does AB 566 require my website to support GPC by January 2027?
AB 566 puts its new duty on browsers. Your obligation as a website operator, to detect and honour an opt-out preference signal such as GPC, already exists under the CCPA and its regulations. The practical effect of AB 566 is that more of your visitors will send the signal.
Will Chrome and Safari actually add opt-out signal support?
The law applies to any business, as the CCPA defines it, that develops or maintains a browser, and it names no browser. From 1 January 2027 such a business may not offer a browser without a setting that sends an opt-out preference signal. The law requires a setting the user can configure, and it does not say the signal must be on by default.
Can I still use targeted advertising if a visitor sends an opt-out signal?
You must stop selling or sharing that visitor's personal information for cross-context behavioural advertising. You can still show contextual ads that do not rely on personal data, and you can use first-party data for on-site personalisation that does not involve sharing with third parties.
Does AB 566 apply to businesses outside California?
The browser duty applies to any business covered by the CCPA that develops or maintains a browser, wherever it is based. The website duty to honour opt-out signals applies to any business subject to the CCPA, regardless of where it is located, for personal information of California residents.
How is AB 566 different from existing GPC requirements?
Existing CCPA regulations already require businesses to honour GPC. AB 566 adds a duty on browser makers to build the signal setting into their products. The likely result is more visitors sending the signal.
What happens if my website ignores the opt-out signal?
As of October 2026, fines are up to $2,663 per violation and $7,988 per intentional violation, and each ignored signal from each consumer may count as a separate violation. The CPPA fined Tractor Supply $1.35 million in September 2025 and PlayOn Sports $1.1 million in March 2026, both in part for failing to honour opt-out preference signals.
Get your opt-out handling ready for 2027
AB 566 will put an opt-out switch in browsers that send nothing today. Kukie.io's banner can treat a GPC signal as an automatic opt-out in the regions where you use an opt-out model, and its cookie scanner lists the cookies your site sets, so you can see what the signal needs to stop.
