US CCPA Minors

A business that has actual knowledge it sells or shares personal information of a consumer under 16 must get affirmative authorization before doing so. For consumers under 13, that authorization must come from a parent or guardian; for consumers at least 13 and under 16, the consumer can give the authorization themselves. The business must establish, document, and follow the applicable process and describe it in its privacy policy.

Determine whether the business has actual knowledge of age, including knowledge it willfully disregards. Then map every disclosure that may be a sale or sharing. Do not begin that sale or sharing until the correct person completes the age-appropriate authorization process.

Product and engineering should enforce the age state and block covered disclosures; privacy or legal should classify sale and sharing and approve the authorization language; advertising and vendor owners should suppress downstream transfers; and support should handle later opt-outs.

Keep the age-band decision, authorization method, identity or parental-verification result, confirmation record, notice version, timestamp, later opt-out, 12-month solicitation hold, and downstream suppression evidence. Minimize the information collected solely to verify age or parental authority; when government identification is used to verify a parent or guardian, delete it promptly after verification.

The CCPA does not require every general-audience business to ask every visitor's age. The trigger is actual knowledge, including willful disregard, and the facts of the product, audience, account data, and collection flow matter.

Compliance with the CCPA minors rule does not establish compliance with the federal Children's Online Privacy Protection Act or other child-safety and privacy laws. COPPA uses different scope and consent tests, and section 7070 states that CCPA consent for sale or sharing is additional to any verifiable parental consent required under COPPA. Separately, personal information of consumers the business actually knows are under 16 is sensitive personal information under the regulations, which can trigger risk-assessment and other controls even when no sale or sharing occurs.

Build the default state so sale and sharing stay off for a known under-16 consumer. Route the consumer to the correct authorization flow, record completion, and activate only the disclosures covered by that authorization.

Recheck the control when the consumer changes age band, withdraws, sends an opt-out preference signal, or when the business adds a new recipient or advertising use.