CCPA Sale of Information for Consumers Less Than 16 Years of Age (120.c)

Overview:
Notwithstanding subdivision (a), a business shall not sell the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer's parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer's personal information. A business that willfully disregards the consumer's age shall be deemed to have had actual knowledge of the consumer's age. This right may be referred to as the "right to opt in."

Action Items:
1) Review existing privacy notices and verify that they meet the new requirements of the CCPA.
2) Ensure websites include a "Do Not Sell My Personal Information" link.
3) If no methods exist, establish appropriate methods for submitting opt-out requests to your organization that comply with the CCPA.
4) Draft an appropriate policy for the authentication of individuals that make opt-out requests.
5) Draft a "play book" that provides standard communications that can be sent to individuals that make opt-out requests.
6) Train employees on how to handle opt-out requests.
7) Verify that the policies in place facilitate the fulfillment of opt-out requests for the period of time required by the CCPA.
8) Create and make available to Consumers the Submission Options noted below: The Business must make available to Consumers two or more designated methods for submitting requests, including, at a minimum, a toll-free telephone number, and if the Business maintains a website, a website address.
9) Establish a means to establish a request is a proper Verifiable Consumer Request (VCR). A "Verifiable Consumer Request" means a request where a Business can verify that the Consumer making the request is the Consumer about whom the business has collected.
10) Create a process to readily access the specific Personal Information the Business has about each Consumer to satisfy this disclosure requirement.
11) Create a tracking system to ensure compliance with the Response Time and that the request complies with the Applicable Time Period. Business must respond to a VCR by mail or electronically within 45 days (which can be extended for an additional 45 days upon notice to the consumer). The Business needs to inform the Consumer of any such extension within 45 days of receipt of the request, together with the reasons for the delay. Note: In a different section, the CCPA states the response to any VCR can be extended for an additional 90 days. It is unclear whether this is in addition to the two 45 day periods noted here. There is no obligation to provide this information to a Consumer more than twice in a 12-month period, and the information provided need only cover the 12-month period prior to the VCR.
12) Create and post a list of the categories of Personal Information collected about Consumers in the preceding 12 months either within the Business' privacy policy or, if the Business does not have a privacy policy, on its website. Establish a process to update this information once every 12 months.
13) Create a tracking system of each disclosure request and how it was handled to be able to demonstrate compliance.
14) Create and post in the Business' privacy policy or on the Business' website if it does not have a privacy policy: (i) the categories of Consumers' Personal Information it has sold, or indicate it has not done so, and (ii) the categories of Consumers' Personal Information it has disclosed for a business purpose, or indicate it has not done so. This must be updated at least once every 12 months.
15) Develop a means of tagging, tracking and separately treating the Personal Information of Consumers who have exercised their opt-out rights.
16) Prominently display the opt-out button on the business website once requirements are released by the attorney general. The Business must provide, on its homepage, a clear link titled "Do Not Sell My Personal Information," which links to an opt-out page. A Business is permitted to create a separate homepage for California Consumers with this link (and omit it from the general homepage) if it takes reasonable steps to ensure California Consumers are directed to the California homepage. The foregoing link and a description of this right must also be disclosed in the Business' privacy policy and any California-specific description of Consumers' privacy rights.
17) Determine what Consumer information is necessary to effectuate an opt-out.
18) Where a Business has purchased Personal Information, develop a verification mechanism to confirm Consumer notification consent prior to further sale of such data.

Related Documents:
1) Privacy Notice / Policy

Additional Guidance:
Age Restrictions
A Business with actual knowledge that a Consumer is between 13 and 16 cannot sell that Consumer's Personal Information without affirmative opt-in consent. A Business that willfully disregards a Consumer's age is deemed to have actual knowledge of the Consumer's age. The CCPA does not provide additional guidance on how willful disregard is determined or if knowledge is presumed for sites directed to children. A Business with actual knowledge that a Consumer is under age 13 cannot sell that Consumer's Personal Information without affirmative opt-in consent of that Consumer's parent or guardian.

Right to Opt-In to Having Information Sold (Minors)
The right to opt-in refers to the requirement within the CCPA that a business cannot sell the personal information of a consumer that is less than 16 years old unless the business has received "opt-in" consent – i.e., affirmative authorization for the sale of the information. If a child is between the ages of 13 and 16 they can provide the necessary opt-in consent directly to the business. If a child is under the age of 13, a parent or guardian must provide the consent.