Law / United States / 
California
CCPA Regulations: consumers less than 16 years of age (article 6)
Also known as CCPA Regulations.
Cal. Code Regs. tit. 11, sections 7070 to 7072
In force since .
A data subject rights rule binding private bodies.
- Obligation class
- Consent, Disclosure
As of .
What it requires
- If you have actual knowledge that you sell or share the personal information of a consumer less than 13 years of age, establish, document and comply with a reasonable method for determining that the person consenting to the sale or sharing is the child's parent or guardian. This is in addition to any verifiable parental consent COPPA requires (section 7070(a)).
- If you have actual knowledge that you sell or share the personal information of a consumer at least 13 and less than 16 years of age, establish, document and comply with a reasonable process for the consumer to opt in to the sale or sharing under section 7028, and when you receive an opt-in request tell the consumer of the ongoing right to opt out and how to do so (section 7071).
- Describe those processes in your privacy policy (section 7072(a)).
These lines are LexLint's reading of the law's text, as of .
Who enforces it
Enforcement body
California Privacy Protection Agency, which may open an investigation on a sworn complaint or on its own initiative (section 7301(a) of the Regulations).
What this law does
Section 7070(a)(1) of the CCPA Regulations requires a business that has actual knowledge that it sells or shares the personal information of a consumer less than 13 years of age to establish, document and comply with a reasonable method for determining that the person consenting is the child's parent or guardian. The parental consent required by section 7070(a)(1) is in addition to any verifiable parental consent required under COPPA.
Under section 7071(a), for a consumer at least 13 and less than 16 years of age whose personal information it has actual knowledge it sells or shares, a business must establish, document and comply with a reasonable process for allowing the consumer to opt in to the sale or sharing. Section 7072(a) requires a business subject to sections 7070 or 7071 to include a description of the processes in its privacy policy. The Agency's regulations became effective on .
When LexLint raises it
When your app profile says your app serves under-18s.