In this system, the default rule is that organizations are entitled to collect certain information (subject to notification requirements) but are required to provide consumers a way to opt out of the sale of that data. The caveat to this rule is that in the vast majority of opt-out bills, explicit consent is required to sell (and sometimes collect) minors’ personal information.

The burden is on adult consumers to exercise their rights and take action to prevent an organization from processing their data. For example, suppose an individual in an opt-out jurisdiction visits a website and enters their email address. In that case, the default rule is that the website has the authority to sell that information to a third party. So long as the company has provided the consumer with adequate notice and provided an opportunity and method to opt out, the sale of such personal information would not be prohibited. However, if the consumer opted out of the sale of personal information, any sale of such information after that right is exercised would be prohibited.

Notably, in every strictly opt-out bill that we have followed this year, this right to opt-out in a strictly opt-out regime generally only enables consumers to prevent the sale (or sharing, depending on the bill) of their personal information. To date, no state has introduced a strictly opt-out privacy bill that also permits a consumer to opt out of the collection of their personal information in certain circumstances.

Examples of strict opt-out privacy regimes in the U.S. include the California Consumer Privacy Act and the 2019 Nevada law.

Strict opt-in

The next approach is a strictly opt-in approach. The least common approach in the U.S., an opt-in regime sets the default rule such that an entity must obtain the consent of a consumer before performing processing activities. Of 25 bills introduced this year, only five include strict opt-in consent requirements for data processing. Of those five, four bills required opt-in consent for the collection and the sale of personal information. Thus, not only is a consumer’s information protected from sale until consent is obtained, but in most U.S. opt-in bills, that information is protected from collection prior to consent, as well.

Rather than placing the burden on the consumer to opt out of the relevant processing, an opt-in regime shifts the burden to the controller to obtain consumer consent. These bills are relatively straightforward to identify and are characterized by language requiring affirmative consent before personal information may be processed in certain ways.

Given these heightened obligations on the part of the business, such bills also tend to be considered more consumer-friendly. What consent means, of course, varies by jurisdiction, and some bills have stricter consent requirements than others. This approach has also been seen in MassachusettsWashington, New York and Oklahoma bills.

Hybrid approach

In addition to the traditional opt-in and opt-out approaches listed above, a third approach has recently emerged and has quickly gained popularity. This is a hybrid approach that incorporates elements of both opt-in and opt-out regimes, depending on the type of personal information being processed. Such regimes almost always consist of some form of opt-out option for general personal information combined with an opt-in regime for certain other types of data that qualify as “sensitive personal information.”

In this regime, a controller may collect and sell a consumer’s personal information (e.g., an email address) without consent, albeit subject to the consumer’s right to opt out. However, a controller, in this case, would be prohibited from collecting or selling sensitive personal information (e.g., an individual’s race or religious beliefs) without first obtaining explicit consent.

A unique characteristic of the opt-out component of hybrid regimes is that every bill introduced to date permits consumers to opt out of collection in certain instances in addition to opting out of the sale. This is significant in that, as mentioned above, all but one strict opt-out system that has been introduced in the U.S. only permits individuals to opt-out of the sale of personal information. Accordingly, because hybrid regimes often allow a consumer to opt out of both the sale and collection of personal data for certain purposes, the opt-out portion of a hybrid regime provides slightly more protections for consumers than a strictly opt-out regime, which only allows a consumer to opt-out of sale.

The most famous example of the hybrid approach is Virginia’s Consumer Data Protection Act, but it can also be seen in bills originating in MinnesotaConnecticutWashington and Utah.

Conclusion

Ultimately, the moral of the story is that consent requirements and opt-out rights are evolving. On its face, the concept of opt-in versus opt out undoubtedly sounds intuitive to those working in the space. Historically, one bill with opt-out rights was the same as the next. However, this is no longer the case. The analysis cannot stop at whether a bill allows for opt-in or opt-out and must extend into consideration how robust those opt-out rights are and examination into whether they are paired with any opt-in requirements.

Photo by Simone Secci on Unsplash