The Boundary of “Universal”: What the Signal Does Not Carry
“Universal opt-out” sounds like a single legal object, but the California and Colorado rules attach different meanings and limits to the phrase. This chapter compares the two signal models using the variables that actually change the result: purpose, choice provenance, mechanism recognition, identity scope, persistence, and reversal. It then separates both browser/device signals from California’s centralized data-broker deletion workflow. The reader should come away able to test a claim about a privacy signal without mistaking broad reach for unlimited legal coverage.
The comparison is useful only if it compares like with like. California and Colorado both describe a consumer choice that can travel among online businesses or controllers. Both can use ordinary machine-readable formats, and both recognize a request that may begin at a browser or device and reach a known consumer when the recipient can make the connection. But these similarities do not make the regimes interchangeable. The purpose carried by the signal, the facts that establish the consumer’s choice, and the system that must receive the request remain jurisdiction-specific.
The comparison works only if the variables stay attached
The first variable is legal purpose. California’s opt-out preference signal is tied to the right to opt out of the sale and sharing of personal information. Colorado’s UOOM can communicate an opt-out from targeted advertising, the sale of personal data, or both. That difference is not a vocabulary preference. It determines which processing a business or controller must stop or restrict.
A signal that California treats as a sale/sharing request should not be described as though it automatically exercises every California privacy right. The California regulations separately address deletion, correction, access, limits on sensitive personal information, and opt-outs of automated decisionmaking technology. Colorado likewise says a controller is not required to honor unrelated rights transmitted through a UOOM. A mechanism can reduce repeated requests for a selected purpose without becoming a single command for every data practice.
Purpose also explains why a shared technical format cannot settle legal meaning. An HTTP header field or JavaScript object may provide a recognizable carrier in both regimes. The carrier tells the receiving organization how to detect the message. It does not tell the organization whether the consumer selected sale, targeted advertising, both, or some other right that the particular rules do not attach to the mechanism. The same shape of message can therefore require different interpretation depending on the jurisdiction and the mechanism’s disclosure.
The second variable is choice provenance: the facts that make the signal a consumer’s affirmative choice rather than an automatic environmental setting. California’s supplied provisions require the mechanism’s configuration or public disclosures to make the sale/sharing effect clear. Colorado goes further in the material provided here by distinguishing a pre-installed default from a consumer-adopted tool. A pre-installed browser that sends a UOOM by default without asking does not establish the required affirmative, freely given, and unambiguous choice. A clear first-run decision with no preselected answer can establish it, as can a consumer’s voluntary installation of a non-pre-installed tool marketed as exercising opt-out rights.