What should teams do about Minors under the US CCPA?
First determine whether the business sells or shares the minor's personal information and what facts give the business of age. Do not collect extra age or identity data without a defined need, but do not ignore account records, birth dates, product design, support contacts, or other facts already known to the business.
For a consumer under 13, establish, document, and use a reasonable method to determine that the person authorizing is the parent or guardian. Section 7070 examples include a signed consent form, a payment method that notifies the primary account holder, a staffed toll-free call, videoconference or in-person verification, and a government-ID check followed by prompt deletion of the identification. This CCPA authorization is additional to any verifiable parental consent required by the federal Children's Online Privacy Protection Act.
For ages 13 through 15, establish, document, and use a reasonable process that lets the consumer affirmatively opt in. After either age path produces authorization, tell the parent, guardian, or consumer about the continuing right to opt out and how to exercise it. The privacy policy must describe the applicable processes.
- Block sale and sharing by default once the business has that the consumer is under 16.
- Use separate authorization paths for under-13 consumers and consumers aged 13 through 15.
- Record the authorization method, person authorizing, scope, timestamp, and systems released from the block.
- Keep refusal and revocation effective across advertising, data, account, and vendor systems.
- If an opted-in minor later opts out, wait at least 12 months before asking the consumer to opt in again, except where the regulations allow an earlier transaction-specific prompt.
When does the CCPA require opt-in for a consumer under 16?
A business with that a consumer is under 16 must obtain affirmative authorization before selling or sharing that consumer's personal information. Willful disregard of age counts as actual knowledge. The rule applies to sale and sharing, not to every collection or use of a minor's personal information, although other privacy laws may impose separate duties.
Who can authorize sale or sharing for a minor under the CCPA?
A parent or guardian must authorize for a consumer under 13. A consumer who is at least 13 and less than 16 may authorize for themselves. The business must keep the age-band decision and use the corresponding process; an under-13 consumer cannot self-authorize under this rule.
How can a business verify a parent or guardian for a child under 13?
Section 7070 requires a reasonable, documented method. Its examples include a signed form returned by mail, fax, or scan; a payment method that notifies the primary account holder; a staffed toll-free call; videoconference; in-person verification; or checking government identification against a database and promptly deleting the identification after verification. The appropriate method depends on the process and risk.
Does CCPA authorization replace COPPA parental consent?
No. Section 7070 states that CCPA consent to sale or sharing is additional to any verifiable parental consent required by the federal Children's Online Privacy Protection Act. A service involving children under 13 must assess COPPA and any other child or teen privacy law separately.
What must happen after a minor opts in?
The business must inform the parent or guardian of an under-13 child, or the consumer aged 13 through 15, of the continuing right to opt out of sale or sharing and the process for doing so. It must preserve the authorization and enforce the resulting status across the affected account, advertising, transfer, and vendor systems.
Does turning 16 automatically authorize sale or sharing?
No. Turning 16 ends the CCPA's special under-16 authorization rule, but it does not convert a prior refusal or opt-out into consent. Existing sale-and-sharing opt-outs remain effective until the consumer later consents through a compliant process.
Binding rule for actual knowledge, willful disregard, age bands, and affirmative authorization.
Sections 7070-7072 govern parent or guardian verification, ages 13-15 opt-in, and privacy-policy notices.