California Considers Far-Reaching New Proposal on Children’s Privacy

Updated December 18, 2024: On September 24, California Gov. Gavin Newsom vetoed the Children’s Data Privacy Act. The governor’s veto statement expressed “support [for] thoughtful approaches to protect minors and limit the collection and use of their personal information, while ensuring they are able to avail themselves of the benefits of internet use” as indicated by the fact that he “previously signed AB 2273 (Wicks, 2023), the Age-Appropriate Design Code Act.” However, Newsom concluded that the Children’s Data Privacy Act “would fundamentally alter the structure of the CCPA [California Consumer Privacy Act] to require businesses, at the point of collection, to distinguish between consumers who are adults and minors. I am concerned that making such a significant change to the CCPA would have unanticipated and potentially adverse effects on how businesses and consumers interact with each other, with unclear effects on children’s privacy.”

As can be seen from the language quoted above, it appears that part of the reason for the veto relates to the passage of the California Age-Appropriate Design Code Act (AADC). For its part, the AADC recently survived a constitutional challenge in the Ninth U.S. Circuit Court of Appeals. See NetChoice, LLC v. Bonta, No. 23-2969 (9th Cir. Aug. 16, 2024). While the appellate court agreed with the district court that the AADC’s data protection impact assessment requirement may violate the First Amendment to the U.S. Constitution, it vacated other parts of the district court’s ruling relating to requirements that businesses estimate the age of users, configure default settings to offer children a heightened level of privacy, and signal to children if they are being monitored by an adult. The case has been remanded to the district court for further proceedings, which are currently underway.

Businesses should continue to monitor developments in state and federal children’s privacy regulations, and be prepared to comply with evolving regulation of children’s data under state comprehensive privacy laws, provisions of the AADC that may survive and similar laws in other states.

On January 29, California Attorney General Rob Bonta announced the introduction of the Children’s Data Privacy Act, which, if passed, would expand and strengthen requirements for processing children’s personal information under the California Consumer Privacy Act (CCPA). As drafted, however, the proposal could have an impact that goes far beyond children’s privacy to change how many businesses collect, use and disclose personal information about both children and adults.

Current CCPA Requirements

While most aspects of the CCPA operate on an opt-out basis, the law currently requires businesses to obtain a consumer’s affirmative authorization to sell or share their personal information if the business has “actual knowledge” that the consumer is under 16 years old. If the business has actual knowledge that the consumer is under 13, it must obtain affirmative authorization from the consumer’s parent or guardian before selling or sharing the consumer’s personal information. Businesses that “willfully disregard” a consumer’s age are deemed to have actual knowledge of the consumer’s age.

Proposed Requirements Under the Children’s Data Privacy Act

The Children’s Data Privacy Act would expand these protections to children under the age of 18 and require affirmative authorization not only for selling or sharing a child’s personal information but also for collecting, using or disclosing it.

Well intentioned as this proposal may be, the breadth of the amended requirements has the potential to upend many aspects of how businesses interact with their customers. First, by eliminating the CCPA’s “actual knowledge” standard in relation to a consumer’s age, the Children’s Data Privacy Act would implicitly require that a business either take steps to confirm a consumer is at least 18 (such as by imposing an age gate on its website or mobile app) or comply with the advance consent requirements regardless of the consumer’s age.

Second, by expanding the consent requirement beyond sales and the sharing of personal information to include the collection, use and disclosure of personal information, the Children’s Data Privacy Act could require businesses subject to the CCPA to obtain affirmative authorization for essentially any activity involving the personal information of minors and anyone whose age the business does not know.

The Children’s Data Privacy Act calls for the California Privacy Protection Agency to adopt regulations “regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age.” These regulations would also be required to “establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age.” While these regulations could help clarify some of the requirements and the preference signal could prove to be an innovative means for verifying a user’s age online, the Children’s Data Privacy Act is likely to impose a significant burden on businesses.

The Children’s Data Privacy Act is yet one more proposal among a number of recent rules focused on children’s privacy and security online. Indeed, at the press conference announcing the Children’s Data Privacy Act, Bonta also announced the Social Media Youth Addiction Law, which would impose a variety of new obligations on social media companies, including requirements to obtain parental consent before providing certain features to children under the age of 18 or sending notifications to children’s devices during specified hours. The Children’s Data Privacy Act follows in the wake of a preliminary injunction issued last September preventing California’s Age-Appropriate Design Code Act (AADC) from taking effect. While the California Attorney General has appealed that decision, the Children’s Data Privacy Act appears to be something of a backup plan in the event the injunction is upheld. It is unclear at this stage whether the Children’s Data Privacy Act will become law. We will be closely monitoring its progress through the California Legislature and any amendments that may narrow its scope or simplify compliance.