US CCPA Minors

Teams should treat Minors under the US CCPA as a source-linked operating decision: if a business has actual knowledge that it sells or shares personal information of a consumer less than 13 years of age, it must establish, document, and comply with a reasonable method for determining that the person consenting is the parent or guardian; if it has actual knowledge that it sells or shares personal information of consumers at least 13 years of age and less than 16 years of age, it must establish, document, and comply with a reasonable process for allowing those consumers to opt in to sale or sharing.

For consumers under 16, the privacy policy must include a description of the processes set forth in sections 7070 and 7071, and the business should route unclear cases to legal, privacy, security, or compliance review before launch.

A visitor would expect direct answers to questions like who counts as a minor under the CCPA, when affirmative authorization or opt-in is required, and what the business must disclose in its privacy policy.

Useful evidence is not just a privacy policy. Keep the source, threshold notes, notice screenshots, request logs, opt-out/GPC tests, vendor terms, and approval trail together.

The common failure pattern is treating CCPA as one static notice instead of checking each collection point, sale/share flow, consumer request, and privacy-policy disclosure against current source material.