The 2021 legislative session has seen a record number of U.S. state-level comprehensive privacy bills introduced. One provision common to most of these bills is the right to opt in or opt out of certain personal data processing. However, not all so-called opt-out or opt-in bills create the same legal obligations. To make sense of this complex landscape, we cataloged the types of processing covered by opt-out and opt-in provisions across state privacy legislation. However, even such categorization can be somewhat misleading, as evidence by the number of footnotes in our chart, and can often fail to provide a complete picture of legal obligations.
That said, for the most part, every bill that has been introduced this past legislative session fits into one of three different categories. These three primary approaches that state legislatures across the country have taken on the issue of consent are strictly opt-out regimes, strictly opt-in regimes and a hybrid approach that includes components of both.
Strict opt-out
This is the most common option in the U.S. and the framework that U.S. consumers are likely the most familiar with. In addition to setting forth requirements for greater transparency, these bills also mandate that a controller provide more accessible mechanisms to enable a consumer to opt out. This is often accomplished by requiring the company to provide a link on their website with some variation of the language “do not sell or share my personal information” or “do not sell my personal information.”
In this system, the default rule is that organizations are entitled to collect certain information (subject to notification requirements) but are required to provide consumers a way to opt out of the sale of that data. The caveat to this rule is that in the vast majority of opt-out bills, explicit consent is required to sell (and sometimes collect) minors’ personal information.
The burden is on adult consumers to exercise their rights and take action to prevent an organization from processing their data. For example, suppose an individual in an opt-out jurisdiction visits a website and enters their email address. In that case, the default rule is that the website has the authority to sell that information to a third party. So long as the company has provided the consumer with adequate notice and provided an opportunity and method to opt out, the sale of such personal information would not be prohibited. However, if the consumer opted out of the sale of personal information, any sale of such information after that right is exercised would be prohibited.
Notably, in every strictly opt-out bill that we have followed this year, this right to opt-out in a strictly opt-out regime generally only enables consumers to prevent the sale (or sharing, depending on the bill) of their personal information. To date, no state has introduced a strictly opt-out privacy bill that also permits a consumer to opt out of the collection of their personal information in certain circumstances.
Examples of strict opt-out privacy regimes in the U.S. include the California Consumer Privacy Act and the 2019 Nevada law.
Strict opt-in
The next approach is a strictly opt-in approach. The least common approach in the U.S., an opt-in regime sets the default rule such that an entity must obtain the consent of a consumer before performing processing activities. Of 25 bills introduced this year, only five include strict opt-in consent requirements for data processing. Of those five, four bills required opt-in consent for the collection and the sale of personal information. Thus, not only is a consumer’s information protected from sale until consent is obtained, but in most U.S. opt-in bills, that information is protected from collection prior to consent, as well.
Rather than placing the burden on the consumer to opt out of the relevant processing, an opt-in regime shifts the burden to the controller to obtain consumer consent. These bills are relatively straightforward to identify and are characterized by language requiring affirmative consent before personal information may be processed in certain ways.
Given these heightened obligations on the part of the business, such bills also tend to be considered more consumer-friendly. What consent means, of course, varies by jurisdiction, and some bills have stricter consent requirements than others. This approach has also been seen in Massachusetts, Washington, New York and Oklahoma bills.
Hybrid approach
In addition to the traditional opt-in and opt-out approaches listed above, a third approach has recently emerged and has quickly gained popularity. This is a hybrid approach that incorporates elements of both opt-in and opt-out regimes, depending on the type of personal information being processed. Such regimes almost always consist of some form of opt-out option for general personal information combined with an opt-in regime for certain other types of data that qualify as “sensitive personal information.”
In this regime, a controller may collect and sell a consumer’s personal information (e.g., an email address) without consent, albeit subject to the consumer’s right to opt out. However, a controller, in this case, would be prohibited from collecting or selling sensitive personal information (e.g., an individual’s race or religious beliefs) without first obtaining explicit consent.
A unique characteristic of the opt-out component of hybrid regimes is that every bill introduced to date permits consumers to opt out of collection in certain instances in addition to opting out of the sale. This is significant in that, as mentioned above, all but one strict opt-out system that has been introduced in the U.S. only permits individuals to opt-out of the sale of personal information. Accordingly, because hybrid regimes often allow a consumer to opt out of both the sale and collection of personal data for certain purposes, the opt-out portion of a hybrid regime provides slightly more protections for consumers than a strictly opt-out regime, which only allows a consumer to opt-out of sale.
The most famous example of the hybrid approach is Virginia’s Consumer Data Protection Act, but it can also be seen in bills originating in Minnesota, Connecticut, Washington and Utah.
Conclusion
Ultimately, the moral of the story is that consent requirements and opt-out rights are evolving. On its face, the concept of opt-in versus opt out undoubtedly sounds intuitive to those working in the space. Historically, one bill with opt-out rights was the same as the next. However, this is no longer the case. The analysis cannot stop at whether a bill allows for opt-in or opt-out and must extend into consideration how robust those opt-out rights are and examination into whether they are paired with any opt-in requirements.
Photo by Simone Secci on Unsplash
