Methods for Submitting Consumer Requests

What it requires

Section 541.055 governs the methods a controller must provide for consumers to submit requests. Its authorized-agent provision (subsection (e)) implements a universal opt-out signal as a technology-based agent designation: a consumer may designate an agent via an internet link, a browser setting or extension, or a global device setting (e.g., GPC) to signal intent to opt out of targeted advertising and the sale of personal data (§ 541.051(b)(5)(A)–(B)). Controllers must honor such a signal, verified with commercially reasonable effort, starting January 1, 2025 — six months after the Act's general July 1, 2024 effective date.

Legal text (excerpt)

A consumer may designate another person to serve as the consumer's authorized agent and act on the consumer's behalf to opt out of the processing of the consumer's personal data under Sections 541.051(b)(5)(A) and (B). A consumer may designate an authorized agent using a technology, including a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device, that allows the consumer to indicate the consumer's intent to opt out of the processing. A controller shall comply with an opt-out request received from an authorized agent under this subsection if the controller is able to verify, with commercially reasonable effort, the identity of the consumer and the authorized agent's authority to act on the consumer's behalf.

Primary source