California's Opt Me Out Act: Browser-Level Opt-Outs Are Coming

What was signed

On October 8, Governor Gavin Newsom signed AB 566, known as the California Opt Me Out Act. The law amends the California Consumer Privacy Act to require any business that develops or maintains a web browser to include a setting that lets consumers send an opt-out preference signal to the sites they visit. The setting must be easy for a reasonable person to find and configure, and browser makers must explain in their disclosures how the signal works. The requirement takes effect on January 1, 2027.

That date is more than a year away, but the law changes an important assumption. Until now, sending a universal opt-out signal has mostly been something privacy-minded users chose to do by installing a specific browser or extension. From 2027, every major browser used in California will need to offer it.

The signal already exists

The most widely used opt-out preference signal today is Global Privacy Control (GPC). When enabled, the browser sends a Sec-GPC: 1 HTTP header and exposes navigator.globalPrivacyControl to scripts on the page. Some browsers and extensions already support it. The largest browsers by share have not offered a native setting, which is the gap AB 566 closes.

Honoring these signals is not new for businesses covered by the CCPA. California's regulations already treat opt-out preference signals as valid requests to opt out of the sale or sharing of personal information. The state has enforced it: in August 2022, the California Attorney General announced a $1.2 million settlement with Sephora that included allegations the company failed to process opt-out requests sent through GPC. Other states have followed with their own requirements to recognize universal opt-out mechanisms, including Colorado and Connecticut.

So the legal obligation to respect the signal is already in place. What AB 566 changes is scale. More users will have the setting within easy reach, and some will turn it on.

Why it matters for ad revenue

When a user sends an opt-out signal, a publisher covered by these laws must stop selling or sharing that user's personal information for cross-context behavioral advertising. In programmatic terms, that typically means passing an opt-out through the bidstream, restricting data processing in the ad server, and not using identifiers for targeted advertising for that user.

Opted-out impressions still sell, but usually for less, because buyers cannot apply audience targeting or frequency capping across sites in the same way. The revenue impact depends on how many of your users enable the signal. Today that share is small for most sites. It is reasonable to plan for it to grow once the setting is built into mainstream browsers.

A simple model helps. Take your current share of California traffic, assume a range of opt-out rates once the setting is universal, and apply the CPM gap you see today between consented and opted-out impressions. The result will be rough, but it turns an abstract legal change into a number your revenue plan can account for, and it shows which levers, such as contextual data or logged-in audiences, would offset the most.

Health publishers face the sharpest edge

Health and wellness publishers are more exposed than most. Their content can reveal sensitive information about a reader, their advertisers are already cautious about data use, and some states have added health-specific privacy laws on top of general ones. For these sites, a growing share of opted-out traffic combined with stricter handling of health-related data means contextual targeting will carry more of the load.

What to do now

1. Measure your current GPC rate. Log the share of sessions that send the Sec-GPC header, by state and browser where you can. This is your baseline for modeling the 2027 impact.
2. Verify you honor it end to end. Confirm that a GPC signal from a California user results in the correct opt-out state in your consent tool, the correct signal in your Prebid configuration, and restricted data processing in your ad server. With Google Publisher Tag, that is typically done through setPrivacySettings with restrictDataProcessing. Test it; do not assume it.
3. Use the IAB Global Privacy Platform. If your consent tool supports GPP, make sure it populates the relevant U.S. state sections, and that Prebid's GPP consent module is configured to read and pass the string.
4. Invest in contextual signals. Page-level categories, keywords and content metadata do not depend on personal data. Make sure they are passed to bidders consistently.
5. Build first-party relationships. Newsletters, registrations and subscriptions create direct relationships governed by your own privacy terms and consent flows. They are the most durable audience asset you have.

What to watch

Browser makers will need to decide how to implement the setting, whether it is on or off by default, and whether they apply it only in California or everywhere. Those choices will determine how much traffic sends the signal in practice. Also watch other states: laws requiring businesses to honor universal opt-outs have spread quickly, and requirements on browsers could follow.

The takeaway

AB 566 does not change what publishers must do when they receive an opt-out signal. It changes how many signals they are likely to receive. The work to prepare is straightforward: measure your baseline, test that your stack honors the signal correctly, and strengthen the contextual and first-party inputs that keep inventory valuable when personal data is off the table. HBDR reviews consent signal handling as part of wrapper audits, because a signal that is received but not passed correctly is both a compliance problem and a revenue problem.