This browser is not actively supported anymore. For the best passle experience, we strongly recommend you upgrade your browser.
Insights Insights
| 1 minute read

More State Efforts to Address Children's Privacy Online: California

California is in court fighting about a draft children's privacy bill. As a stop gap while the state fights it out about that first bill, it has introduced new legislation that would supplement the state's overall privacy law (CCPA) with provisions specific to children under 18. The proposed new law would require “affirmative authorization” to collect from, use, share, or sell data about under-18s.  (Currently, the CCPA offers some protections for users 16 and under.)  For under-13s, the law would require parental consent.  

Why It Matters

The more laws there are in the privacy arena, and the more regulators grow to like passing them, the better the chances of unintentionally broad consequences. There is already a federal law on the books that requires “verifiable parental consent” regarding online data from children under 13 when a service is “directed to” children. That law, however, was passed in the 1990s – the infancy of the internet and long before the always-on, device-driven era of social media. As the nature of media consumption has changed, so has the appetite of regulators to craft much broader rules that are not necessarily confined to “kids' media." Now, it is much more likely that online services will have to comply with some children's privacy rules even if they are not actively seeking children as their user base.  The sheer number and complexity of the rules makes this a tricky compliance proposition.  

Subscribe to Taylor English Insights by topic here.

The proposed Children's Data Privacy Act would prohibit businesses from collecting, using, sharing or selling personal data of minors under age 18 without "affirmative authorization" while data practices against users under 13 will require informed parental consent. Bonta said the extended coverage "closes a gap" in the CCPA that leaves 17-year-olds "exposed" to unwanted data processing. Additionally, the bill empowers the California Department of Justice to seek civil penalties of up to USD5,000 for individual violations.


data security and privacy, hill_mitzi, insights, youth services law