California Consumer Privacy Act of 2018: opt-out preference signal.

The bill was assigned Chapter number 465 and received the Governor's approval date of October 8, 2025.

Header changed from enrolled format (with blank signature/date lines) to the authenticated electronic legal material format used for chaptered bills.

Removed the entire requirement that businesses developing or maintaining a mobile operating system must include an opt-out preference signal setting, along with its 6-month post-regulation delay and the definition of 'mobile operating system.'

Added a new immunity provision (subsection d) stating that a business that develops or maintains a browser with the required opt-out functionality shall not be liable for a violation of the CCPA by a business that receives the opt-out preference signal.

Added a fixed operative date of January 1, 2027 (subsection f), replacing the previous structure where the browser requirement had no stated start date and the mobile OS requirement was delayed until 6 months after agency regulations were adopted.

Changed the required feature from 'a setting that enables a consumer to send an opt-out preference signal' to 'a setting functionality configurable by a consumer that enables the browser to send an opt-out preference signal,' shifting the actor from the consumer to the browser itself.

Expanded the public disclosure requirement to include 'the intended effect of the opt-out preference signal' in addition to how it works and what types of personal information it applies to.

Removed the word 'primarily' from the browser definition, changing it from software 'primarily used by consumers to access, locate, and navigate internet websites' to software 'used by consumers to locate, access, and navigate internet websites,' which could broaden what qualifies as a browser.

All references to 'browser engine' were removed from the bill, including its definition (the software component that interprets and renders web content, such as Blink, Gecko, and WebKit). The obligation now applies only to businesses that develop or maintain a browser, not to those that build or maintain the underlying rendering engine.

The requirement for browser developers to disclose 'the types of personal information to which the signal would apply' in their public disclosures was removed. They must still explain how the opt-out preference signal works and its intended effect, but no longer need to specify which categories of personal data are covered.

Language was cleaned up from 'a setting functionality configurable by a consumer that enables a consumer the browser to send' to simply 'functionality configurable by a consumer that enables the browser to send,' removing the redundant word 'setting' and fixing grammatical issues left over from prior amendments.

The bill now prohibits developing or maintaining a 'browser engine' without an opt-out preference signal setting, not just a 'browser.' A new definition of 'browser engine' is added, covering software components that interpret and render web content (HTML, CSS, JavaScript), explicitly naming Blink, Gecko, and WebKit. This extends obligations to companies that build the underlying rendering technology used by many browsers and web-enabled applications.

The phrase 'Unless otherwise prohibited by federal law' was removed from the beginning of the main prohibition, eliminating a federal preemption carve-out that could have limited the bill's application where federal law conflicts.

A new subdivision requires a business that develops or maintains a browser or browser engine to make clear in its public disclosures how the opt-out preference signal works and the types of personal information to which the signal would apply.

The definition of 'browser' was expanded from 'primarily used by consumers to access internet websites' to 'primarily used by consumers to locate, access, and navigate internet websites,' adding 'locate' and 'navigate' to broaden what qualifies as a browser.

The regulatory authority provision was simplified. The old version specifically authorized the agency to update definitions of 'browser' and 'mobile operating system' to address changes in technology, data collection, obstacles to implementation, or privacy concerns. The new version simply says the agency may adopt regulations as necessary to implement and administer the section.

A short title was added: 'This act shall be known as the California Opt Me Out Act.'

Capitalization fix in Section 1798.136(a)(1): changed lowercase 'a business' to 'A business' at the start of the sentence.

Added the word 'provisions.' at the end of the legislative counsel's digest paragraph about regulatory authority, and added a standalone line reading 'section.' in the bill text between subdivision (c) and subdivision (d). These appear to be minor drafting corrections or possible errors.

Version header updated from 'as introduced' to 'as amended' and page numbers shifted from 99 to 98 due to reformatting.