California Proposes CCPA Amendments to Further Protect Children's Privacy
Proposed amendments to the California Consumer Privacy Act would require businesses to obtain opt-in consent prior to collecting, selling, sharing, using, or disclosing a minor's personal information.
On January 29, 2024, California Attorney General Rob Bonta announced the introduction of the Children's Data Privacy Act, a bill that would further amend the California Consumer Privacy Act ("CCPA"). The bill places new obligations on companies processing the data of minors and attempts to align the CCPA with other state privacy laws related to children's privacy.
The new bill would amend the CCPA in three key ways:
- Implementing an Opt-In Requirement. A covered business would be required to obtain affirmative authorization prior to collecting, selling, sharing, using, or disclosing the personal information of any minor between 13 and 18 years old. If the minor is under 13, such consent would be required from the child's parent or guardian.
- Removing the "Actual Knowledge" Carve-Out. Under current law, a business subject to the CCPA cannot engage in the unconsented-to sale or sharing of a minor's personal information if the business has actual knowledge that the consumer is a minor. Under this amendment, however, a business must always obtain the requisite affirmative consent, even when they are unaware of the consumer's age.
- Requiring Adoption of Age-Verification Regulations. The proposed amendment requires the California Privacy Protection Agency to adopt regulations (i) "to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer's parent or guardian" to specify the age of the consumer, and (ii) "regarding age verification and when a business must treat a consumer as being less than 13 or 18 year of age" (as applicable). Such regulations must be adopted on or before July 1, 2025, after the solicitation of public comments.
Pursuant to the proposed amendment, the California Department of Justice may seek civil penalties of up to $5,000 per violation.
This bill represents states' growing focus on children's privacy. In the same press conference, Bonta also introduced the Protecting Youth from Social Media Addiction Act, while a battle over the California Age-Appropriate Design Code Act is ongoing. Similarly, the Federal Trade Commission recently proposed revisions to the Children's Online Privacy Protection Act. Though the bill has not yet passed, businesses that collect data from individuals under the age of 18 should start preparing for compliance now.
