Some companies are bypassing state privacy laws by ignoring universal opt-out signals from users outside certain states. Senator Wyden is urging action. The debate could impact how publishers and platforms handle user data.
Media and publishing professionals face new uncertainty as businesses reportedly sidestep state privacy laws by ignoring universal opt-out signals from users whose IP addresses suggest they are outside specific states. Senator Ron Wyden has called out this practice, warning that companies are undermining consumer rights by relying on commercial GeoIP databases to determine user location and, in turn, which privacy laws apply. These databases, he noted, are often inaccurate, potentially depriving users of their legal ability to reject ad tracking through tools like the Global Privacy Control (GPC).
Wyden’s letter, sent to attorneys general in ten states with universal opt-out requirements, highlights that while some major companies honor GPC signals from all website visitors, others only comply when they believe a user is physically present in a state mandating such protections. This selective approach, according to Wyden, strips rights from mobile populations such as college students, business travelers, and commuters who may be temporarily outside their home state but still wish to exercise their privacy rights.
Staff at the California Privacy Protection Agency reportedly confirmed to Wyden’s office that California residents retain their privacy rights, including the use of GPC, regardless of their physical location. However, legal experts like Santa Clara University’s Eric Goldman question whether this interpretation would withstand a court challenge, citing constitutional limits on states regulating out-of-state activity. Goldman suggested that while honoring user preferences is important, legal interventions may not be the best solution, and territory-based laws inherently limit enforcement reach.
Justin Brookman of Consumer Reports argued that states have a legitimate interest in protecting residents from privacy violations, even when they travel. Wyden urged attorneys general to issue guidance requiring companies to honor universal opt-out signals from state residents regardless of their current location or IP address, or to provide a way for users to self-certify their residency. He also called for a bipartisan, multi-state task force to coordinate enforcement, stating that a unified regulatory front would make clear that geographic filtering is not a loophole.
Industry groups are watching closely. David LeDuc of the Network Advertising Initiative said the organization would welcome state guidance and acknowledged the limitations of IP-based location lookups. He noted that these technical shortcomings strengthen the argument for a national privacy standard. The debate over universal opt-outs and state privacy enforcement echoes broader tensions in digital regulation, as seen in other recent disputes such as the government’s handling of press subpoenas, discussed in this coverage of federal legal actions involving media rights.
