The California Consumer Protection Act will come into effect Jan. 1, 2020. So, what does that mean for California children under 16? Children today are digital natives, born and brought up with innovative technology at their fingertips. They start creating a digital footprint as soon as they learn how to swipe and tap on a tablet or smartphone. As such, the CCPA protects their personal information by prohibiting its sale unless consent has been obtained.
What is the right to opt in?
The right to opt in means businesses cannot sell the personal information of consumers that are 16 years old or younger without prior authorization. If the minor is less than 13 years old, the businesses must obtain authorization from a parent or guardian. If the minor is between the ages of 13 and 16 years old, businesses can obtain authorization from the minor.
What are the penalties?
The California attorney general can bring a civil action against any business, service provider or another person that violates the CCPA. A violator may face up to $2,500 fine per violation or $7,500 per intentional violation, in addition to any injunctions granted. Businesses will be held liable as having actual knowledge if the business willfully disregards the consumer’s age.
What does 'willfully disregard' mean?
The term “willfully disregard” is similarly used in the California Contractors’ State License Law, which requires contractors to be licensed in order to provide construction services. The Contractors’ State License Law states, “[w]illful or deliberate disregard and violation of the building laws of the state…constitutes a cause for disciplinary action.” In ACCO Engineered Systems v. Contractors’ State License Bd., the Contractors’ State License Board found ACCO in violation of the Contractors’ State License Law when ACCO failed to get a building permit before replacing a boiler. The court determined “willful” only required a showing of general intent to act, instead of a specific intent to violate the law. The court also stated the use of the term “willful” does not preclude a licensee who acted in good faith from liability. Ultimately, the court found ACCO's “affirmative decision to not inquire about the permitting requirements…this conduct constitutes willful disregard.”
Therefore, “willfully disregard” under the CCPA may be interpreted to mean an affirmative decision to not inquire about the age of consumers.
What should a business do?
There has been a legislative trend to increase restrictions on the personal information of minors. Businesses may need to take a more proactive approach rather than reactive approach. Right now, the legislature is the one applying the pressure on businesses but soon the voice of digital natives will pressure businesses to be more responsible in the handling of their personal information.
In order to avoid potential exposure to CCPA liability, businesses that have reason to believe children under 16 use their services may need to implement an age-gate mechanism before consumers can access their platform and before businesses decide to sell the data. They may also be able to find other creative solutions to identify the age of their users. For example, facial-recognition technology could be used to identify if a user is a minor. However, some of these solutions may run afoul of the principle of data minimization and businesses should cautiously consider their implications by performing a privacy impact assessment before deploying them.
Photo by Ben Wicks on Unsplash