Consumers Less Than 13 Years of Age

What it requires

A business with actual knowledge that it sells or shares the personal information of a consumer under 13 must have a documented, reasonable method for confirming that whoever consents to the sale or sharing is the child’s parent or guardian, in addition to any verifiable parental consent COPPA requires. The section lists acceptable methods, such as a signed consent form, a payment card transaction, a staffed toll-free line, or a video call. Once consent is given, the business must tell the parent or guardian about the right to opt out on the child’s behalf, and it must verify parental status the same way for requests to delete, correct, or know a child’s data.

Regulation text

(a) Process for Opting-In to Sale or Sharing of Personal Information (1) A business that has actual knowledge that it sells or shares the personal information of a consumer less than the age of 13 shall establish, document, and comply with a reasonable method for determining that the person consenting to the sale or sharing of the personal information about the child is the parent or guardian of that child. This consent to the sale or sharing of personal information is in addition to any verifiable parental consent required under COPPA.

California Consumer Privacy Act / California Privacy Rights Act, § 7070Read the full section from California Privacy Protection Agency (CalPrivacy)