Regulators of data privacy laws have expressed a desire in recent months to intensify enforcement around opt-out preference signals, also known as universal opt-out mechanisms (the “Opt-Out Signals”).
Opt-Out Signals allow consumers to automatically opt-out of the sale and sharing of personal information for targeted advertising across all websites they may visit through an internet browser or mobile operating system.
Currently, although most browsers provide users some level of privacy settings, of the approximately eleven states that require businesses to honor Opt-Out Signals, none require that browsers actually provide those signals.
If a business fails to comply with an Opt-Out Signal, regulators can impose fines and other penalties for noncompliance. In September 2025, state regulators in various states, including California, Colorado and Connecticut indicated expanded enforcement through investigative sweeps of companies’ compliance with consumer requests to opt-out, including those related to Opt-Out Signals.
Also in September 2025, the California legislature passed AB 566, the California Opt Me Out Act, which if signed by the governor, would require both internet browsers and mobile operating systems to offer these Opt-Out Signals in their settings. Though unclear how many people will be aware of, or how many will elect to, use Opt-Out Signals, the universal opt-out mechanism will allow consumers to avoid opting out from each individual website, and will require businesses to navigate further compliance and implementation burdens.