California's "opt Me Out Act" Makes Browser-Based Opt-Out a Baseline

On October 8, 2025, California enacted the “Opt Me Out Act” (AB 566), the first U.S. law requiring web browsers that operate in California to ship an easy-to-find, built-in setting allowing users to send a universal opt-out preference signal (often implemented via Global Privacy Control, or “GPC”). When enabled, the browser signal instructs websites not to sell or share personal information, operationalizing California Consumer Privacy Act (CCPA/CPRA) opt-out rights at scale. The law authorizes the California Privacy Protection Agency (CPPA) to adopt implementing regulations and takes effect January 1, 2027. This editorial explains what the law does (and does not) cover—especially the status of mobile browsers—how it interacts with existing universal opt-out regimes in states like Colorado and Connecticut, what it means for opt-out requests and DSAR workflows, and the practical pros and cons for businesses. Finally, it outlines why this shift is advantageous for enterprise privacy programs and how leading solutions such as CaptainCompliance.com can reduce risk and cost through automation.