Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

On January 29, California Attorney General Rob Bonta announced the introduction of the <a href="https://legiscan.com/CA/text/AB1949/2023">Children’s Data Privacy Act</a>, which, if passed, would expand and strengthen requirements for processing children’s personal information under the California Consumer Privacy Act (CCPA). As drafted, however, the proposal could have an impact that goes far beyond children’s privacy to change how many businesses collect, use and disclose personal information about both children and adults.

core/paragraph

core/heading

While most aspects of the CCPA operate on an opt-out basis, the law currently requires businesses to obtain a consumer’s affirmative authorization to sell or share their personal information if the business has “actual knowledge” that the consumer is under 16 years old. If the business has actual knowledge that the consumer is under 13, it must obtain affirmative authorization from the consumer’s parent or guardian before selling or sharing the consumer’s personal information. Businesses that “willfully disregard” a consumer’s age are deemed to have actual knowledge of the consumer’s age.

Proposed Requirements Under the Children’s Data Privacy Act

The Children’s Data Privacy Act would expand these protections to children under the age of 18 and require affirmative authorization not only for selling or sharing a child’s personal information but also for collecting, using or disclosing it.

Well intentioned as this proposal may be, the breadth of the amended requirements has the potential to upend many aspects of how businesses interact with their customers. First, by eliminating the CCPA’s “actual knowledge” standard in relation to a consumer’s age, the Children’s Data Privacy Act would implicitly require that a business either take steps to confirm a consumer is at least 18 (such as by imposing an age gate on its website or mobile app) or comply with the advance consent requirements regardless of the consumer’s age.

Second, by expanding the consent requirement beyond sales and the sharing of personal information to include the collection, use and disclosure of personal information, the Children’s Data Privacy Act could require businesses subject to the CCPA to obtain affirmative authorization for essentially any activity involving the personal information of minors and anyone whose age the business does not know.

The Children’s Data Privacy Act calls for the California Privacy Protection Agency to adopt regulations “regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age.” These regulations would also be required to “establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age.” While these regulations could help clarify some of the requirements and the preference signal could prove to be an innovative means for verifying a user’s age online, the Children’s Data Privacy Act is likely to impose a significant burden on businesses.

The Children’s Data Privacy Act is yet one more proposal among a number of recent rules focused on children’s privacy and security online. Indeed, at the press conference announcing the Children’s Data Privacy Act, Bonta also announced the <a href="https://legiscan.com/CA/text/SB976/2023">Social Media Youth Addiction Law</a>, which would impose a variety of new obligations on social media companies, including requirements to obtain parental consent before providing certain features to children under the age of 18 or sending notifications to children’s devices during specified hours. The Children’s Data Privacy Act follows in the wake of a preliminary injunction issued last September preventing California’s <a href="https://www.bakerlaw.com/insights/californias-landmark-age-appropriate-design-code-act-what-you-need-to-know/">Age-Appropriate Design Code Act</a> (AADC) from taking effect. While the California Attorney General has appealed that decision, the Children’s Data Privacy Act appears to be something of a backup plan in the event the injunction is upheld. It is unclear at this stage whether the Children’s Data Privacy Act will become law. We will be closely monitoring its progress through the California Legislature and any amendments that may narrow its scope or simplify compliance.

California Considers Far-Reaching New Proposal on Children’s Privacy