The California Opt Me Out Act (AB 566) was signed in October 2025 and takes effect January 1, 2027. It requires every web browser operating in California to include a built-in setting that broadcasts an opt-out preference signal, telling every site you visit not to sell or share your personal information. Here is what it actually changes.
What AB 566 Requires
AB 566 amends the California Consumer Privacy Act (CCPA). From January 1, 2027, browsers that operate in California must ship an easy-to-find, built-in setting that lets you send a universal opt-out preference signal. Today that capability exists mainly as a third-party extension or a niche setting in privacy-focused browsers. The law makes it standard equipment.
It is the first law of its kind in the United States, and it puts the mainstream browsers — Chrome, Safari, Edge and the rest — squarely in scope.
How an Opt-Out Preference Signal Works
An opt-out preference signal is a machine-readable message your browser attaches to every page request. The best-known implementation is Global Privacy Control (GPC). Instead of you hunting for a “Do Not Sell or Share My Personal Information” link on each individual site, your browser announces the request automatically, everywhere, all the time.
Under the CCPA, businesses that receive a valid signal must already treat it as a legitimate opt-out of the sale or sharing of your personal information. What AB 566 adds is the other half of the equation: making sure ordinary people actually have the switch. See our explainer on Global Privacy Control and universal opt-out signals for the mechanics.
Browsers Are Covered — Phones' Operating Systems Are Not
This is the detail most summaries get wrong. Earlier drafts contemplated obligations on mobile operating systems, but the enrolled text of AB 566 focuses on browsers. In practice:
- In scope: desktop and mobile web browsers operating in California — including Safari on iOS and Chrome on Android, as browsers.
- Not directly mandated: iOS and Android themselves, as operating systems. A system-wide, app-level opt-out switch is not what this law delivers.
That matters because a large share of tracking happens inside apps rather than in a browser tab, and AB 566 does not reach it.
Who Is Liable
The law splits responsibility cleanly. Browser developers must include the setting, but they are shielded from liability for what websites do with the signal. Businesses that receive the signal carry the duty to honor it, and the penalties if they do not. Enforcement sits with the California Privacy Protection Agency (CPPA), alongside the Attorney General.
Why this took two attempts
The predecessor bill, AB 3048, cleared the legislature in August 2024 and was vetoed by Governor Newsom that September — his stated reasoning was that browsers already offered the option or a plug-in, while no major mobile operating system did. AB 566 came back narrowed to browsers and was signed on October 8, 2025.
What It Means for You as a Californian
From January 2027, exercising your CCPA opt-out rights across the entire web becomes a single toggle rather than a per-site chore. Concretely:
- You will find the setting in your browser's privacy preferences, without installing anything.
- Every CCPA-covered business you visit receives the request automatically.
- You no longer have to locate a “Do Not Sell or Share” link on each site, or re-do it after clearing cookies on every one.
You do not have to wait for 2027, though. GPC is already supported today in browsers such as Brave, Firefox and DuckDuckGo, and via extensions in Chrome and Edge. Turning it on now gives you most of the benefit early.
Skip the manual work
PrivacyOn removes your personal information from 100+ data broker sites and keeps it removed — automatically.
Start your free scan★★★★★ 4.8/5 · Trusted by thousands of families
The Big Limitation: It Does Not Delete Anything
An opt-out signal is forward-looking
AB 566 stops businesses from selling or sharing your data going forward. It does not reach back and delete the profile a data broker already built, and it does not remove your name, address, phone number, and relatives from the people-search sites that already publish them.
This is the gap people consistently misjudge. A browser signal is an instruction to the sites you personally visit. The data broker that bought your details in 2019, or scraped them from county property records, never sees your browser at all — it has no page you load and no signal to receive. Those profiles stay online until somebody files a deletion request against each broker individually.
So treat AB 566 as the tap and broker removal as the bucket. Turning off the tap is necessary; it does not empty what is already there.
How AB 566 Fits With California's Other Privacy Tools
- CCPA/CPRA deletion requests: your right to demand a business delete what it holds. See how to file a CCPA deletion request.
- DROP (Delete Request and Opt-Out Platform): California's one-stop deletion portal under the Delete Act. Since August 1, 2026, registered data brokers must process DROP requests every 45 days. Read our DROP explainer.
- AB 566 opt-out signal: stops the ongoing sale and sharing from January 1, 2027.
- Per-broker opt-outs: still the only way to clear individual people-search listings, including brokers not registered in California.
Used together, these cover the full lifecycle: stop the flow, delete the stock, and monitor for re-listing.
Does AB 566 Apply Outside California?
Formally it protects California residents, but the practical effect is national. Browser makers are not going to build and maintain a California-only build of Chrome or Safari — the setting will ship to everyone. Whether a business outside CCPA's reach honors your signal is a separate question, but a growing number of state privacy laws already require covered businesses to respect universal opt-out signals, so the setting will do real work well beyond California.
Frequently Asked Questions
When does the California Opt Me Out Act take effect?
January 1, 2027. AB 566 was signed into law on October 8, 2025, giving browser developers a lead time to build the setting in. Websites' obligation to honor a valid opt-out preference signal already exists under the CCPA today.
What is the difference between AB 566 and AB 3048?
AB 3048 was the earlier attempt. It passed the legislature in August 2024 and was vetoed in September 2024, partly because it would have covered mobile operating systems as well as browsers. AB 566 is the narrowed successor, limited to browsers, and it was signed in October 2025.
Does AB 566 cover apps on my phone?
Not directly. The law covers browsers, including mobile browsers like Safari on iOS and Chrome on Android. iOS and Android as operating systems are not mandated to provide a system-wide opt-out switch, so tracking that happens inside apps rather than in a browser is outside its reach.
Do I still need to opt out of data brokers if I turn on the signal?
Yes, and this is the most important thing to understand about AB 566. An opt-out preference signal only reaches sites you actually visit, and it only stops future selling and sharing. It cannot delete the profile a people-search site already publishes about you, because that broker never sees your browser. Those listings stay up until a deletion request is filed against each one.
Can I use an opt-out preference signal before 2027?
Yes. Global Privacy Control is already built into Brave, Firefox and DuckDuckGo, and available as an extension for Chrome and Edge. Enabling it today gives you most of what AB 566 will make standard, without waiting.
Who enforces AB 566?
The California Privacy Protection Agency, alongside the Attorney General. Browser developers must ship the setting but are shielded from liability for websites' violations — the duty to honor the signal, and the penalties for ignoring it, fall on the businesses receiving it.
Turn Off the Tap, Then Empty the Bucket
AB 566 is a genuine win: from 2027, one browser setting will assert your opt-out rights across the web automatically. But the profiles already sitting on data broker and people-search sites — your address, phone number, age, and relatives — will not move an inch because of it. PrivacyOn handles that half: it finds your listings across 100+ data brokers, files the deletions, and monitors 24/7 so they stay down, with dark web monitoring and family plans for up to 5 people from $8.33/month. Enable GPC today, then run a free PrivacyOn scan to see what is already out there.