Commentary Addressing Risks and Opportunities Through the Lifecycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

<img class="wp-image-5978 alignright" src="https://dataprivacymonitor.bakerhostetlerblogs.com/wp-content/uploads/sites/5/2020/01/children-online-iStock-509634080_1200x630_72dpi.jpg" alt="" width="438" height="230" />

Those who keep an eye on privacy laws may be familiar with how monumental the Children’s Online Privacy Protection Act (COPPA) was when it first became effective in 1998. COPPA requires online services that directly target children under the age of 13, or reasonably know that children visit the online service, to obtain verifiable parental consent before collecting personal information from the children. COPPA is meant to bring extra protections to children, but with the European Union’s General Data Protection Regulation (GDPR) giving protections to minors under the age of 16 beginning May 25, 2018, U.S. policymakers questioned whether there was a gap in online privacy laws that address young teens.

Nearly two decades after COPPA, the California Consumer Privacy Act (CCPA) and its amendments, which became effective this year on Jan. 1, are disrupting U.S. privacy law, including as it relates to young teens, by giving California residents who are at least age 13, but not yet 16, the right to opt in to the sale of their personal information. With the CCPA’s broad definition of “sale,” which many have argued occurs when advertising cookies share data for building cross-service profiles for tailored advertising, this new right threatens ad revenues for publishers that may serve a teen population.

The CCPA generally gives California residents, herein referenced as consumers, the right to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. The CCPA defines a sale broadly, including any “making available” of personal information for monetary or nonmonetary valuable consideration. The California Attorney General, in charge of enforcing the CCPA, has deemed this right the “right to opt-out” in its Proposed Text of Regulations, which acts as guidance for interpreting the CCPA and contains additional requirements.

For young teens, however, the CCPA additionally prohibits businesses from selling personal information of a consumer between ages 13 and 16 without that consumer’s affirmative consent. The Attorney General’s Proposed Regulations refer to this right as the “right to opt-in” and offer guidance for implementing this right. The Proposed Regulations explain that opting in to the sale of personal information must be a two-step process. This two-step process first requires the consumer to “clearly request to opt-in” and then, separately, to confirm that choice. This confirmation could conceivably be achieved through some sort of verification email or perhaps even by requiring that consumers check a box indicating their intent to exercise their right one last time before submitting their requests.

In a nod to COPPA, the CCPA also prohibits the sale of personal information of a child consumer under age 13 without the affirmative consent of that consumer’s parent or guardian. The Attorney General’s Proposed Regulations require a business to establish, document, and comply with a reasonable method for determining that a child’s parent or guardian affirmatively authorizes the sale of the personal information about the child. To achieve this, the Proposed Regulations outline the following ways to meet this verification requirement:
<ul>
 	<li>Obtaining a consent form signed by the parent or guardian.</li>
 	<li>Allowing the parent or guardian to use a credit/debit card in connection with a monetary transaction.</li>
 	<li>Communicating with a parent or guardian through trained personnel in person or via a toll-free phone number or videoconference.</li>
 	<li>Obtaining the parent’s or guardian’s government-issued identification.</li>
</ul>
In any case, whether a business is selling personal information of minors between ages 13 and 16 or of minors under age 13, the Attorney General’s Proposed Regulations add the requirement, which is not in the CCPA, that businesses disclose in a privacy policy whether or not the business sells the personal information of minors under age 16 without affirmative authorization. While this may seem innocuous at first glance, this particular requirement presents a serious problem: There is no knowledge qualifier guidance from either the CCPA or the Proposed Regulations. If a business states in its privacy policy that it does not sell the personal information of consumers under age 16 and is later accused of doing so when, for example, a child has lied about her or his age, or the site operator is simply unaware of the age of its users, that business has now potentially violated its own privacy policy, the CCPA, and the Proposed Regulations and could conceivably be held liable for deceiving consumers.

The Attorney General’s Proposed Regulations do not close interpretation gaps when it comes to understanding how broadly a sale is defined and how a business could determine that its data practices are not impacting minors’ personal information without having to spend resources setting up specific mechanisms. Accordingly, all content publishers, and especially publishers of content that may be of interest to teens, are at risk of running afoul of the “right to opt-in” if they have interest-based advertising cookies and other data practices that are potentially a sale and do not limit those to users who are at least age 16 absent an opt-in.

The situation could be made somewhat better if the final regulations clarified that the “right to opt-in” applies only where the business knows or should reasonably know the consumer is under age 16. However, even then there will be negative repercussions for publishers and consumers. General audience sites will likely raise their age of eligibility to use the services from 13, the current U.S. standard, to 16 or even the age of majority (18 in most states). Publishers that cater to teens are likely to have to limit their data and advertising practices, which will reduce revenue and may lead to less freely available content for teens. Publishers may have to start charging for content, which will impact less-affluent families.

The final version of the regulations is expected to be published in the coming months. If the final regulations do not take a practical approach, the big loser will be economically disadvantaged youth.

Hoping for a New Year’s Resolution: Clarity on the Sale of Personal Information of California Minors