CCPA vs. COPPA: working with children’s information

COPPA and the CCPA are compatible statutes. Compliance with COPPA does not eliminate the need for compliance with CCPA or vice versa, so obtaining parental consent under the CCPA does not eliminate the need to do so under COPPA where required. Neither statue requires you to know or to ask how old your consumers are, and the rules change under both statutes as soon as you know that you are collecting information from a child.

Under CCPA, as soon as you have actual knowledge or a strong reason to know that a consumer is younger than age 16, you must obtain opt-in consent before selling their information. In other words, the CCPA flips from an opt-out to an opt-in statute for children. How you should obtain the opt-in varies depending on the age of the consumer.

Children under age 13

If the child/consumer is younger than age 13, only a parent or guardian can provide the opt in, and you must verify that the person making the opt in is the child’s parent or guardian using a reasonable and documented method. E.g., you can require a signed and sworn statement to be sent to you electronically or via post. You can also require possession of a payment card or obtain and then delete a copy of a government ID. 

Note how these rules differ from those for verifying an adult consumer’s identity. In that context, the CCPA encourages businesses to verify consumers without requesting any new or sensitive information such as a government ID, and in the context of opting in a child, the CCPA explicitly allows this practice. 

As part of processing an opt in, inform the parent of their right to opt out again later and how they can exercise that right. 

Children over age 13

For children aged 13-15, the child herself or himself can opt in the sale of their personal information using the same two-step opt-in procedures that you use for adults who are opting into sales after first having opted out of (see Soliciting and Responding to opt-in requests).  As part of processing an opt in, inform the child of their right to opt out again later and how they can exercise that right. 

How to Document and Audit CCPA Compliance
Privacy Rights Discrimination and Loyalty Programs