Here’s a summary of the three new privacy laws signed by Gavin Newsom on October 8, 2025 in California:
- AB 566 – California Opt Me Out Act
- Requires browser developers (for browsers used by Californians) to include a built-in “opt-out preference signal” (sometimes called OOPS) that lets users send a global opt-out request for sale/sharing of their personal information, rather than opting out on each website.
- The law specifically states the browser maker forwarding the signal is not liable if a website fails to honor it.
- Effective date: January 1, 2027.
- SB 361 – Defending Californians’ Data Act
- Expands the existing data-broker registration law in California (under the California Consumer Privacy Act / California Privacy Protection Agency regime) by requiring data brokers to disclose more detailed information about the types of sensitive personal information they collect (e.g., mobile advertising identifiers, connected TV IDs, vehicle identification numbers) and whether they sold or shared data with foreign actors, governments or generative-AI developers in the past year.
- Compliance deadline for businesses that qualify as data brokers: January 31, 2026.
- Effective date of law provisions: January 1, 2026.
- AB 656 – Click to Cancel 2.0
- Applies to social-media platforms with more than US$100 million in annual gross revenue. These platforms must provide a clear and accessible way for users to delete (or suspend) their account — and account deletion must trigger full deletion of the user’s personal data.
- Requires each user-interface screen visible to a user to include a clear message how to delete/suspend the account.
- Effective date: January 1, 2026.
Why this matters
- These laws strengthen consumer privacy rights in California in three distinct ways: easier broad opt-out for data sales/sharing (AB 566); greater transparency for data broker practices (SB 361); and improved control over social-media account deletion and underlying data (AB 656).
- Businesses operating in California (or targeting California residents) will need to adjust their compliance programs accordingly — especially browser developers, data brokers, and large social-media platforms.
- The staggered effective dates (2026, 2027) give some time to implement but also mean planning ahead is critical.
