Law / United States / 
Puerto Rico
Ley para la Protección de la Privacidad Cibernética de los Niños y Jóvenes (children's online privacy)
Ley Núm. 185 de 27 de agosto de 2024
In force since .
A sensitive categories rule binding private bodies.
- Enforcement body
- Negociado de Telecomunicaciones de Puerto Rico (NET), exclusive jurisdiction
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Obligation class
- Consent, Data subject rights, Retention, Disclosure
- Audit expectation
- none
What it requires
- Do not publish or disclose a known minor user's personal information beyond their name and city of residence without the minor's and a parent's or guardian's consent.NIST Privacy FrameworkCT.PO-P1
- Do not store, sell, share, or retain a known minor's personal information beyond what is reasonably necessary to provide the service the minor is actively using.NIST Privacy FrameworkCT.PO-P2
- Do not profile a known minor through fully automated processing of their personal information unless the profiling is reasonably necessary to the service or serves a compelling, minor-protective purpose, and safeguards are in place.NIST Privacy FrameworkCT.PO-P1
- Do not store, sell, or share a known minor's precise geolocation beyond what is reasonably necessary, and only for as long as necessary.NIST Privacy FrameworkCT.PO-P2
- Give every minor user resident in Puerto Rico a simple, understandable process to set their privacy options as part of account registration.NIST Privacy FrameworkCT.PO-P3
- Delete a minor user's account, or their personal information at a parent's or guardian's request, within forty-five calendar days of the request.NIST Privacy FrameworkCT.DM-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P4Data elements can be accessed for deletion.
- FINOS AIGF
- AIR-PREV-006Data Quality & Classification/Sensitivity
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionNo
Penalty structure
The compiled statutory text prints the figure as "veinticinco mil diez mil dólares ($25,0000.00)", an apparent duplicated-numeral error carrying an extra zero; contemporaneous press coverage of the enacted Act (WAPA.tv, Metro Puerto Rico, NotiUno) uniformly reports the penalty as $25,000 per violation, which this record follows.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 25,000
What it makes you log
Logging duty
Article 4 bars a social media site or application that lets users aged 18 or under register from publishing a known minor's personal information without a parent's or guardian's consent, from storing, selling, sharing or retaining a known minor's personal information that is not reasonably necessary to provide the service, from profiling known minors, from using the information to the minor's detriment, and from storing precise geolocation beyond the limited time needed; it requires a privacy-settings process at registration and removal of an account or of personal information within 45 calendar days of a request. The retention and profiling clauses let the network proceed if it can show a compelling purpose in the minor's best interest or the required safeguards, which is a showing of a ground for an exception and not a record, and the geolocation and removal clauses limit the personal data itself. The Law names no log, register or record, sets no retention period for a record, and gives the Negociado de Telecomunicaciones exclusive enforcement authority and rulemaking power without a power to demand a record. English: 'A social media website or application is prohibited from storing, selling, sharing or retaining a known minor's personal information that is not reasonably necessary to provide the service.' The Law reaches known minor users resident in Puerto Rico (Article 4(a) and (f)).
- Kind
- None
- As of
What this law does
Every social-media website or app that permits registration of a user eighteen or younger and resident in Puerto Rico must not publish or disclose that user's personal information (beyond name and city) without the parent's or guardian's consent, must not store, sell, share, or retain a known minor's personal information beyond what is reasonably necessary to the service, and must not profile a known minor absent a compelling, minor-protective purpose.
Precise geolocation of a known minor may not be stored, sold, or shared beyond what the service reasonably requires. The platform must give every minor user a simple privacy-settings process at registration and must honor an account-deletion or data-removal request within forty-five days. The law is designed not to conflict with the federal Children's Online Privacy Protection Act for users under thirteen.
The Negociado de Telecomunicaciones de Puerto Rico (NET) has exclusive enforcement authority and may impose a civil penalty of up to $25,000 per violation.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .