Law / United States / 
California
Privacy Rights for California Minors in the Digital World
Officially Privacy Rights for California Minors in the Digital World
Cal. Bus. and Prof. Code sections 22580 to 22582
In force since .
A data subject rights rule binding private bodies.
- Criminal exposure
- No
- Private right of action
- No
- Obligation class
- Prohibition, Data subject rights, Disclosure
- Audit expectation
- none
As of .
What it requires
- If your website, online service or app is directed to minors, meaning it is created to reach an audience predominately comprised of minors and is not intended for a more general audience of adults, do not market or advertise on it any product or service listed in section 22580(i), among them alcoholic beverages, firearms, ammunition, tobacco and electronic cigarettes, cannabis, dangerous fireworks, lottery tickets, tanning in an ultraviolet device, tattoos and body branding, drug paraphernalia and obscene matter. Marketing or advertising means a communication made in exchange for monetary compensation.
- Whatever your audience, do not market or advertise those products or services to a minor (a person under 18 who lives in California) you have actual knowledge is using your service, when the marketing is specifically directed to that minor based on information specific to the minor, such as profile, activity, address or location. Reasonable actions in good faith to avoid that marketing count as compliance.
- If your service is directed to minors or you have actual knowledge that a minor uses it, do not knowingly use, disclose or compile the minor's personal information, or allow a third party to, with actual knowledge that it is for marketing or advertising those products or services to that minor.
- If your service is directed to minors or you have actual knowledge that a minor uses it, let a minor who is a registered user remove, or request and obtain removal of, content or information the minor posted. Give the minor notice that they may do so, clear instructions for doing so, and notice that removal does not ensure complete or comprehensive removal.
- You need not erase content that a federal or state law requires you to keep, that a third party stored or posted, that you anonymize, that a minor who did not follow your removal instructions posted, or that the minor was paid to provide. Making the content invisible to other users and the public is enough even if it stays on your servers. You are not required to collect or retain age information about users.
- If you run an advertising service and an operator notifies you, in the manner you require, that its service is directed to minors, do not market or advertise those products or services on that operator's service.
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Attorney General. The chapter names no enforcing body, states no penalty and creates no private right of action of its own. A violation can be pursued as an unlawful business practice under the Unfair Competition Law (Bus. and Prof. Code section 17200 et seq.), which lets the Attorney General, a district attorney and certain city attorneys and county counsel seek a civil penalty of up to $2,500 per violation (section 17206), and lets a person who has suffered injury in fact and lost money or property as a result sue (section 17204).
Settledness
- As of
- Open questions
- Does a service open to all ages but with a section aimed at teenagers count as "directed to minors" when section 22580(e) covers "a portion thereof" created to reach an audience "predominately comprised of minors"?
- What counts as "actual knowledge" that a user is a minor under sections 22580(b) and 22581(a) when the operator holds a self-declared birth year or other age signal that does not establish the user's age?
What this law does
Bars an operator of a website, online service or app directed to minors from marketing or advertising on it the products and services listed in section 22580(i), including alcoholic beverages, firearms, ammunition, tobacco, cannabis, electronic cigarettes and lottery tickets.
An operator of any website or app may not market or advertise those products or services to a minor it has actual knowledge is using the service, when the marketing is specifically directed to that minor based on information specific to that minor. Taking reasonable actions in good faith designed to avoid that marketing or advertising counts as compliance.
An operator directed to minors, or with actual knowledge that a minor is using its service, may not knowingly use, disclose, or compile a minor's personal information, or allow a third party to, with actual knowledge that it is for marketing or advertising those products or services to that minor. A minor is a natural person under 18 years of age who resides in California.
A service is directed to minors when it, or a portion of it, is created to reach an audience predominately comprised of minors and is not intended for a more general audience comprised of adults. An advertising service notified by an operator that its service is directed to minors may not market or advertise those products or services on it.
The advertising restrictions do not apply to the incidental placement of products or services embedded in content that is not distributed primarily for marketing or advertising them. Marketing or advertising means a communication made in exchange for monetary compensation, the primary purpose of which is to encourage recipients to purchase or use the product or service. Section 22580 does not require an operator to collect or retain age information about users.
An operator directed to minors, or with actual knowledge that a minor is using its service, must let a registered minor user remove, or request and obtain removal of, content or information the minor posted, and must give the minor notice and clear instructions. An operator must notify a registered minor that removal does not ensure complete or comprehensive removal of the content or information posted.
An operator is not required to erase content in the circumstances listed, among them content posted by a third party, content the operator anonymizes, and content for which the minor received compensation. An operator complies if it renders the content no longer visible to other users and the public even if it remains on the operator's servers. The chapter became operative on . Section 22580 was last amended by Chapter 347, Statutes of 2018 (AB 3067), effective .
Section 17204 of the Business and Professions Code lets a person who has suffered injury in fact and lost money or property as a result of unfair competition sue.
When LexLint raises it
When your app profile says your app serves under-18s.