CCPA Opt In Consent: Children’s Data under California Consumer Privacy Act
CA business compliance professionals need to be aware that the opt-out requirement of the California Consumer Privacy Act (CCPA) is modified for children under the age of 16 years old. Instead of the general opt-out, the business must collect opt-in consent starting on January 1, 2020 in order to sell the personal information of a consumer under the age of 16 years old. This is referred to under the CA privacy law as the “right to opt in” for kids.
Between 13 and 16 years of age, the consumer must affirmatively authorize the sale of their personal information. If the child is under the age of 13 years old, a parent or guardian must affirmatively authorize the sale of information.
The CCPA imposes an actual knowledge requirement on businesses in order for there to be a violation with regard to the children’s consent provision. However, the actual knowledge requirement is strengthened over a similar section in the Children’s Online Privacy Protection Act (COPPA), the federal government law which has been in effect for more than a decade. The CCPA explicitly provides that a business which willfully disregards the consumer’s age has actual knowledge of the consumer’s age.
As a result, businesses under the CA privacy law will need to ask consumers whether they are 16 years of age or older. Otherwise, they will be liable for violating the law if they sell the personal information of children.
GETÂ OUR FREE WHITE PAPER ON THE NEW CALIFORNIA LAW …
The law could also have implications for the federal government’s enforcement of COPPA. Most businesses under the federal law bar minors from using their service and never ask a new user if they are a child. By doing so, they avoid gaining actual knowledge that COPPA applies because they never ask if a consumer is 13 years old or younger. However, in order to comply with the California law, they would potentially open the business up to COPPA liability.
The result could ultimately be that California businesses decide to filter out the personal information of anyone under 16 years of age and not sell it. If the law has the side effect of strengthening COPPA, then it could put teeth in a law with substantial penalties for businesses with actual knowledge that they are collecting data on children.
The California law would follow the implementation of GDPR on children’s data, which provided for a similar requirement of opt-in consent by a parent or guardian for children starting in May 2018. Congress is also considering the Do Not Track Kids Act, which would extend COPPA to children up to 16 years of age.
Related Content
Consent Management Software Platform
Preference Management Software Solution
Opt In & Opt Out Consent Software for CCPA
Right to Opt Out in CCPA
Mobile App Consent Manager
Service Providers and the Right to Opt Out under the California Consumer Privacy Act
Opt In Consent for Children in CCPA
How to Obtain Consent Under GDPR
Best Practices for GDPR Consent
GDPR’s Special Categories of Personal Data
Verbal Consent Under GDPR
GDPR-K: Children’s Data and Parental Consent