Privacy Law
Not All Fun and Games: Children’s and Teenagers’ Online Privacy Laws
By Jonathan Tam
A patchwork of online privacy laws accord special protections to children and teenagers in California, and the regulatory landscape is quickly evolving.
At the federal level, the Children’s Online Privacy Protection Act (“COPPA“) and related regulations govern the online collection, use, disclosure and other processing of personal information from children under 13. COPPA only applies to operators of online services that are directed to children and operators that have actual knowledge that they process personal information from children. Covered operators must issue separate privacy notices directly to parents and legal guardians (collectively, “parents“) explaining how they process their children’s personal information, and obtain verifiable parental consent before doing so. COPPA also requires covered operators to observe data minimization requirements, give parents the right to access and delete their children’s personal information, and implement reasonable data security measures. Authorities have stepped up their enforcement of COPPA in recent years, with the Federal Trade Commission securing payments of hundreds of millions of dollars from alleged COPPA violators in the past couple of years. There have also recently been legislative efforts and administrative initiatives to expand the scope and strengthen the protections of COPPA and its regulations.
At the state level, the California Consumer Privacy Act of 2018 (“CCPA“) and related regulations impose heightened restrictions on processing personal information of children and teenagers residing in California. For example, the CCPA prohibits covered businesses from selling, or sharing for cross-context behavioral advertising, the personal information of children under 13 without their parents’ consent and the personal information of teenagers 13-15 years old without the teenager’s consent. In addition, a chapter of the Civil Code entitled Privacy Rights for California Minors in the Digital World gives minors under 18 residing in California special online privacy rights. For instance, operators of online services directed to minors and operators of online services that have actual knowledge that minors are using their online services must generally permit minors who are registered users of the service to remove content that they posted to the service, and tell them how they can exercise this right.
The California Age-Appropriate Design Code Act (“CAADCA“) may also impose additional obligations on operators of online services likely to be accessed by minors under 18 residing in California. However, in September 2023, a federal court found the statute to be unconstitutional on free speech grounds and preliminarily enjoined its enforcement. The California Attorney General is appealing the decision. If the CAADCA is found to be constitutional, it would require covered businesses to adhere to ten affirmative obligations and eight prohibitions regarding the processing of minors’ personal information. For example, before publicly offering an online service likely to be accessed by minors, covered businesses would have to complete a data protection impact assessment that identifies risks of material detriment to minors arising from the business’ data management practices, and create a timed plan to mitigate or eliminate the risks before launching the service.
Companies that offer online services that are attractive to children and teenagers should therefore ensure that they comply with existing privacy provisions related to young people’s personal information and monitor developments in this quickly evolving area.
Jonathan Tam is a partner in Baker McKenzie’s San Francisco office with robust experience advising online entertainment, video game and media companies on U.S. and global privacy, cybersecurity, IP and consumer protection issues. Jonathan is also the Chair of the Bar Association of San Francisco’s Privacy and Cybersecurity Section. He is licensed to practice law in the U.S. and Canada, and is an alum of the University of Toronto Faculty of Law and Harvard University.
