Operating systems and applications: privacy settings.

Plain English Breakdown

The official source does not provide specific details on enforcement mechanisms or penalties for non-compliance.

Privacy Settings for Operating Systems and Apps

This law requires that operating systems and applications set their default privacy settings to be the most protective option available, and it stops them from changing a user's chosen privacy setting without explicit permission.

What This Bill Does

• Sets the default privacy setting on new devices or apps to the highest level of protection offered by the system or app.
• Does not allow changes to a user’s chosen privacy settings unless the user gives clear consent.

Who It Names or Affects

• Users of operating systems and applications
• Companies that make or sell operating systems and apps

Terms To Know

Privacy setting

Any user-configurable option within an application’s privacy menu that controls how personal information is collected, used, shared, disclosed, retained, or processed.

Limits and Unknowns

• The bill does not specify what happens if a user does not give explicit consent to change their privacy settings.
• It is unclear when this law will take effect since an effective date has not been set yet.

Official Summary Text

AB 2561, as amended, Valencia.
Operating systems and applications: privacy settings.
Existing law, the California Consumer Privacy Act of 2018, grants a consumer various rights with respect to personal information that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information, as specified.
Existing law, beginning January 1, 2027, prohibits a business from developing or maintaining a browser, as defined, that does not include functionality configurable by a consumer that enables the browser to send an opt-out preference signal, as defined, to businesses with which the consumer interacts through the browser, as prescribed.
This bill would
require an operating system or an application to configure a user’s default privacy
setting to be the most privacy protective setting offered by the operating system or application and would
prohibit an operating system or an application from
changing
undoing a user’s affirmative configuration of
a user’s privacy setting without the user’s
explicit
consent.
The bill would define “privacy setting” to mean any user-configurable option within an application’s privacy, or similarly labeled, menu that governs the application’s collection, use, sharing, disclosure, retention, or processing of the user’s personal information.

Current Bill Text

Download Bill PDF