Many U.S. states have recently added provisions regarding “minors” that greatly exceed what is required under the Children’s Online Privacy Protection Act (COPPA). In short, the new laws generally apply to people under 18, not just children under 13.
Do these new laws apply to you? You don’t need to “direct your service at children” to fall in scope. Rather, many laws use a standard of “willful disregard”…without defining the term.
The Office of the Colorado Attorney General has now come to the rescue with proposed amendments to the Colorado CPA provisions on processing the data of minors.
What is willful disregard? Consider factors such as:
1) Did you directly receive information from a parent or consumer indicating that the consumer is a minor. This includes:
- Collecting DOB at sign up (whether it’s a mandatory or an optional field).
- DOB is required and the user went back and changed it to an older age.
- Parent informed you of a minor using the service.
- Consumer provides their age in the bio section of a profile.
- Consumer provides other information like grade level in the profile.
2) The website or service is directed at minors. Consider: subject matter, visual content, language and use of minor-oriented activities and incentives.
- Marketing and promotional materials that specifically appeal to minors
3) You categorize a consumer as a minor for marketing, advertising or internal business purposes.
- You use consumer data (user generated content) to estimate the age and serve ads based on this estimation.
4) Consider what other jurisdictions said. We already have some guidance from Florida, Maryland and Vermont that adds the following to the above (on willful disregard or “reasonably likely to be accessed” by a child).
Some specifics:
- Directed at children (FTC COPPA test).
- Determined, based on competent evidence regarding audience composition or internal company research, to be routinely accessed by a significant amount of minors. (Vermont: That is composed of at least two percent minors two through 17 years of age.)
- The product is substantially similar or the same as another product that has been held to be directed at minors.
- Internal research shows that a significant amount of the audience is composed of minors.
- You knew or should have known that at least two percent of the audience includes minors (Vermont).
Some general standards:
- You knew or should have known that a user is a minor.
- Based on the facts or circumstances readily available to the controller, should reasonably have been aroused to question whether a consumer was a child and thereafter failed to perform reasonable age verification. (Florida)
[View source.]
