When a Browser Signal Becomes a Legal Request
A browser can send a privacy signal in the time it takes to load a webpage. The harder question is what that signal means once it reaches a business. This series examines how state privacy rules turn a machine-readable choice into a legal request, and how that request is limited by purpose, identity, persistence, and the systems that hold or share personal information. The practical goal is not to memorize one protocol field. It is to learn how to ask whether a signal is legally actionable, what it reaches, and what the recipient must do next.
The distinction matters because a technical event and a legal event are not the same thing. A website may receive thousands of headers and JavaScript values without any of them carrying an obligation. But California's regulations define an “opt-out preference signal” as a mechanism that communicates a consumer's choice to opt out of the sale and sharing of personal information. When a qualifying signal reaches a business that sells or shares personal information, the regulation requires the business to process it as a valid opt-out request. Colorado uses the related term “Universal Opt-Out Mechanism” and specifies how such a mechanism can communicate a choice about targeted advertising, the sale of personal data, or both.
The central subject, then, is not a browser feature in isolation. It is the relationship among four actors: a consumer who makes a choice, a platform or device that transmits it, a business or controller that interprets it, and the downstream systems or organizations that must change their processing. The signal becomes legally meaningful at the point where the applicable rule connects those actors to a defined right and purpose.
The request is born before the website sees a form
Traditional privacy requests are easy to picture. A consumer clicks a link, fills out a form, sends an email, or signs into an account. A browser signal changes the shape of that interaction. The consumer may make the choice once in a browser or device, and the mechanism can communicate the choice to many businesses without a separate form for each one.
California's rule makes the legal translation explicit. A qualifying signal must use a format commonly used and recognized by businesses; the regulation gives an HTTP header field or JavaScript object as examples. More important than the format is the public meaning of the mechanism. Its configuration or disclosures must make clear that using it is intended to opt the consumer out of the sale and sharing of personal information. The message is therefore not legally significant merely because it is machine-readable. It must carry a communicated choice about a recognized purpose.
That creates a chain of responsibility:
The consumer supplies the choice, but the browser does not decide the legal scope by itself. The receiving organization must determine whether the signal fits the applicable rule, what purpose it controls, and which records it can connect to the signal. Its systems then have to carry the resulting state into advertising, sale, sharing, processor, and confirmation workflows. A signal provider also has a role: the rules restrict the use of information gathered to send or process the opt-out, rather than allowing the mechanism to turn the privacy choice into an unrelated source of profiling.
This is why “legal request” is a better description than “privacy preference.” A preference can remain a local setting. A legally recognized request changes what the recipient is permitted or required to do. The change is not unlimited, but within its defined scope it is no longer optional simply because the consumer did not use the business's preferred form.
Universal reach still needs a legal scope
The word “universal” describes convenience, not unlimited coverage. California's signal rules focus on opting out of sale or sharing. Colorado's UOOM rules allow a consumer to select targeted advertising, the sale of personal data, or both. Neither description turns the signal into a general command to delete every record, correct every fact, restrict every sensitive-data use, or refuse every automated decision. The legal purpose must remain attached to the signal as it travels.
The same discipline applies to identity. California requires an in-scope online business to treat a valid signal as a request for the browser or device and any consumer profile associated with it, including pseudonymous profiles. If the business knows the consumer, it must also treat the signal as a request for that consumer. This produces a ladder of possible reach rather than a single yes-or-no identity result:
- At minimum, the browser or device that sent the signal is covered.
- A pseudonymous profile linked to that browser or device may also be covered.
- A known account or consumer can bring the request to additional records when the business can make the connection.
- Offline sale or sharing may be covered when the business has the information needed to apply the choice there.
The signal itself is not identity proof. A business cannot assume that an unnamed browser belongs to a particular person merely because the signal exists. California permits a business to offer the consumer an opportunity to provide additional identifying information when that would help extend the request to offline activity, but the business cannot make that information a condition of honoring the browser- or device-level request. Information supplied for this purpose is limited to sending or processing the opt-out.
Colorado makes another part of the scope question visible: how the consumer adopted the sending tool. A UOOM may not simply be the default setting of a pre-installed browser or operating system if the consumer was never asked to choose it. A clear first-run choice with no preselected answer can establish the required affirmative, freely given, and unambiguous choice. The rules treat the voluntary installation of a tool marketed as exercising opt-out rights differently: in that setting, installing the tool can itself establish the choice even if the tool later sends the signal by default.
The result is a crucial boundary. Two signals might look alike on the wire while having different legal significance because the jurisdictions define different purposes or because the consumer's choice was established differently. Syntax helps a recipient detect a message. It does not, by itself, answer what the consumer chose, which law applies, or how far the request reaches.
Two request architectures, not one
A browser signal creates a request at the point of online interaction. The receiving business or controller must apply it to the scope the rules recognize, maintain the opt-out rather than treating a later absence of the signal as consent, and take the downstream actions needed to stop or restrict the relevant processing. California requires a way to display whether the signal was honored and distinguishes that status display from disruptive pop-ups. Colorado permits a conspicuous status display and requires a controller to continue treating the browser, device, and known consumer as opted out until the consumer gives compliant consent. In both systems, opting back in is a separate affirmative event, not the default result of changing browsers or remaining silent.
California's 2026 data-broker rules describe a different architecture: the Delete Request and Opt-out Platform, or DROP. A California consumer submits a deletion request through the platform after residency verification. A data broker creates an account, selects the kinds of identifiers that match its records, and retrieves consumer deletion lists containing hashed identifying information, a transaction identifier, and the hashing algorithm. The broker must access its selected lists at least every 45 calendar days, compare them with standardized and hashed records, delete covered information when there is a match, preserve a limited suppression rule for future collection when there is not, direct service providers and contractors to act, and report statuses such as “record deleted” or “record not found.”
DROP is not the next stage of every browser signal. The supplied California rules do not say that a browser opt-out automatically creates a DROP request, and they do not make DROP a universal browser-signal receiver. The two mechanisms solve related but different problems. A signal communicates a purpose-specific opt-out during online interactions. DROP is a verified, centralized workflow for sending deletion requests to data brokers and reconciling those requests against records that may have been collected outside a first-party relationship.
That distinction provides the first durable test for machine-readable privacy choices. Ask five questions in order: Which jurisdiction and rule apply? What purpose does the signal communicate? How was the consumer's choice established? Which browser, device, profile, consumer, or offline records can the recipient connect it to? What state changes and downstream duties follow after receipt? Then ask a sixth question when data brokers or deletion are involved: Is this actually a separate request architecture such as DROP?
A browser signal becomes a legal request when the answer to those questions is grounded in the applicable rule, not when a product labels it “universal.” The California rules provide a clear first case because they connect a defined signal to a defined sale/sharing right and then specify the scope of the business's response. The next step is to examine that translation closely: what California requires at the moment the signal arrives, and where the law deliberately stops.