California State Legislature Passes Children’s Privacy Amendments to the CCPA, Pending Governor’s Signature
On August 29, 2024, the California State Assembly passed California bill AB-1949, following the bill’s passage in the California State Senate. AB 1949 currently awaits approval by Governor Newsom.
If enacted, AB-1949 would amend the California Consumer Privacy Act (as amended by the California Privacy Rights Act) (the “CCPA”) to significantly expand privacy protections concerning the personal information of consumers under the age of 18.
Currently, under the existing CCPA, a business is required to obtain affirmative opt-in consent prior to selling or sharing the personal information of a consumer under the age of 16. In the case of a consumer under the age of 13, a business is required to obtain consent from the consumer’s parent or guardian. AB-1949 increases the above-described age threshold from 16 to 18, and prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is under the age of 18, unless prior affirmative opt-in consent is obtained.
AB-1949 also creates new opt-in requirements regarding the collection, use, or disclosure of personal information of consumers under the age of 18. These requirements prohibit a business from collecting, using, or disclosing the personal information of a consumer if the business has actual knowledge that the consumer is under the age of 18, unless the consumer, in the case of a consumer at least 13 years of age and less than 18 years of age, or the consumer’s parent or guardian, in the case of a consumer less than 13 years of age, has affirmatively authorized the collection, use, or disclosure of the consumer’s personal information.
The bill requires the California Privacy Protection Agency to issue regulations establishing technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age.
If AB-1949 is enacted, California will join an increasing number of states with heightened privacy requirements for individuals under 18.