Right on the heels of game-changing revisions to the federal rule implementing the Children’s Online Privacy Protection Act, and almost immediately following another change to the California Online Privacy Protection Act (“CalOPPA”)1 regarding Do Not Track disclosures, California has passed a law that further complicates the landscape for companies’ online interactions with children: On September 23, 2013, the state amended CalOPPA to include a section titled “Privacy Rights for California Minors in the Digital World.”2
Most significant, the revised law will require an online company to permit a registered user who is under 18 to remove content that he or she has posted to the company’s website or app. The law will also prohibit online companies from advertising “adult” products to minors and from collecting, using or disclosing minors’ personal information for such advertising – or allowing others to do so. With these revisions, CalOPPA moves from being purely a disclosure law to actually imposing substantive requirements on certain companies that do business online.
As a practical matter, the revised law has nationwide reach because it applies to any “Internet Web site, online service, online application, or mobile application” (each, a “Site”) that collects personal information about California minors and is “directed to minors” or has “actual knowledge” that a minor is using the Site.3 As a result, Site operators should be aware of these developments and adjust their business practices to comply with the revised law before it takes effect on January 1, 2015.
CALOPPA’S NEW RIGHT TO REMOVE CONTENT
Perhaps the most significant new change to CalOPPA is its requirement that a Site operator permit a registered user who is under 18 to remove content that the user had posted to the Site.4
Specifically, a Site operator must:
- Permit covered minors to remove or to request and obtain removal of content or information “posted” (i.e., accessible to others) by the user on the operator’s Site;
- Provide clear instructions on how the minor may remove or request removal of the content; and
- Provide notice that the minor may remove or request removal of the content, but that the removal does not ensure complete or comprehensive removal of the content.
To this last point, the law’s scope is somewhat limited because it does not require removal of content posted or reposted to the Site by third-party users.5 Moreover, the law does not require a Site operator to permanently delete the content from its servers. Rather, the operator may comply by taking steps to dissociate the content from a particular user or to render it invisible to other users while retaining it on its server.
NEW LIMITS ON ADVERTISING TO MINORS
CalOPPA’s expansion also prohibits Site operators from advertising adult-oriented products, such as alcohol, tobacco and firearms, to minors and from collecting, using or disclosing minors’ personal information for such advertising – or allowing others to do so.6 Like the right to remove content, this provision will apply to any Site that is directed to minors or that has actual knowledge that the advertising will be targeted to a minor. Importantly, the revised law creates a safe harbor for a Site operator that uses an advertising service provider to serve its advertising: If it notifies its advertising service provider that the Site is directed to minors, then the responsibility to comply with the law rests with the advertising service provider.7
WHAT DO THESE NEW PROTECTIONS FOR MINORS MEAN FOR SITE OPERATORS?
The revised law’s effective date is not too far off. Site operators should therefore start thinking about whether they fall within the law’s coverage and, if they do, what new procedures are necessary to come into compliance.