The Ninth Circuit has unanimously ruled that a proposed class action about the wrongful collection and use of children's online data may proceed under various state laws. The suit was tossed out originally because the defendants argued that state law was preempted by a federal online children's privacy law, and that the federal regulators had already enforced the federal law.
Why It Matters
The defendants now face the possibility that behavior for which they have already been investigated and fined by the feds will also subject them to class action liability under the state laws of multiple states. The decision points to the increasing role the states plan to play in the area of personal data privacy. It also foreshadows that children's privacy in particular may require close attention. Various privacy laws taking effect in California and elsewhere in 2023-2024 contain special provisions relating to the data of minors under a certain age threshold (13, 16, or 18, depending on the law). This decision, the existing state laws on which it is based, and the pending state law obligations about children's data, suggest that dealing with children online may be an area of close observation and higher risk in the future.