Last year, California made child-related revisions to its Online Privacy Protection Act that have ramifications even for websites and other online services that are not directed to children. The revision, “Privacy Rights for California Minors in the Digital World,” imposes obligations on any website, application, or other online service that (1) is directed to minors—that is, was created to reach an audience predominantly composed of minors—or (2) has actual knowledge that a minor is using it because, for example, it collects date of birth (each, a “Covered Service”). Cal. Bus. & Prof. Code §§ 22580-81. Covered Services are thus not limited to services directed to minors: even a general audience or adult-directed service is subject to the law if it collects age information and permits those who identify as minors to use the service. The law does not require an operator to collect age from its users.
The revised law takes effect on January 1, 2015. It will require a Covered Service to permit a registered user who is a minor to remove content that he or she has posted. It will also prohibit a Covered Service from advertising adult products to minors and from collecting, using, or disclosing minors’ personal information for such advertising, or allowing others to do so.
The Delete Button Requirement
The law will require a Covered Service to permit a registered user who is under 18 to remove content that he or she has posted to the service. Specifically, it will have to:
- Permit a minor to remove, or to request and obtain removal of, content that he or she has posted to the service (“posted” means that the content is accessible to others); and
- Provide instructions (e.g., in its privacy policy) on how a minor may remove or request removal of posted content, along with an explanation that removal does not ensure complete or comprehensive removal of the content.
Cal. Bus. & Prof. Code § 22581. The explanation that removal does not ensure complete or comprehensive removal is necessary because the law does not require removal in certain situations, including if another provision of law requires the Covered Service to maintain the content, if it was posted or reposted by users other than the minor, or if the minor received consideration in exchange for the posting. Cal. Bus. & Prof. Code § 22581(b)(1), (2), (5). Moreover, the law does not require permanent deletion of removed content. Rather, a Covered Service may comply with a removal request by: (1) anonymizing the content so that the minor cannot be individually identified; or (2) rendering the content invisible to others, while retaining it on its servers.
Limits on Advertising
The revised law also prohibits Covered Services from advertising adult products, such as alcohol, tobacco, and firearms, to minors and from collecting, using, or disclosing minors’ personal information for such advertising, or allowing others to do so. Cal. Bus. & Prof. Code § 22580. This provision applies to a Covered Service that is directed to minors or that has actual knowledge that the advertising will be targeted to a minor. If a Covered Service uses a service provider to deliver its advertising and notifies the service provider that the service is directed to minors, then the responsibility to comply with the law rests with the service provider. Cal. Bus. & Prof. Code § 22580(h)(1)-(2).
What Does This Mean in Practice?
Each operator of a website, app, or other online service should determine whether it falls within the law’s coverage and, if so, develop a strategy to achieve compliance before the law takes effect on January 1, 2015. When doing so, we suggest that:
- If you operate a general audience or adult-directed site or service and you do not have a business need for your users’ age information, do not collect age or date of birth from your registered users on a going-forward basis. This will limit your need to comply, at least with respect to new users.
- If you operate a Covered Service and permit users to post information or content (such as through a profile, blog, chat, message board, or similar feature), consider whether you will let registered users who are minors remove their posted content themselves or request to have it removed (or anonymized) by you. In either case, in your privacy policy, provide notice of the minor’s right, along with instructions and an explanation that removal does not ensure complete removal. For example:
If you are under 18 and a registered Site user, you may ask us to remove content or information that you have posted to the Site by writing to [email address]. Please note that your request does not ensure complete or comprehensive removal of the content or information, as, for example, some of your content may have been reposted by another user.
- If you have actual knowledge that you are targeting advertising to minors, ensure that your advertising does not promote any of the adult products covered by the law.
- If you have actual knowledge that you have collected personal information from a minor, put policies and procedures in place to ensure that such information is not collected, used, or disclosed—by you or any third party—to advertise adult products.
- If you operate a Covered Service that is directed to minors: (1) do not advertise adult products; (2) take steps to ensure that your users’ personal information is not collected, used, or disclosed—by you or any third party—to advertise adult products; and (3) inform your advertising service providers that your service is directed to minors.