Existing law, the California Consumer Privacy Act of 2020 (CCPA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, requires a consumer, as defined, to have various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about a consumer to third parties to not sell or share the consumers personal information. The act prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information.

This bill would instead prohibit a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 18 years of age and would revise the above-described prohibition to prohibit a business from selling or sharing the personal information of a consumer over 13 years of age, but less than 18 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information, as specified. The bill would require a business to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.

The CCPA requires the Attorney General to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 16 years of age. The act requires the California Privacy Protection Agency, as specified, to adopt regulations under the authority assigned to the Attorney General under the act.

This bill would instead require the Attorney General to solicit broad public participation and adopt regulations, as described above, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age.

The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020.

Existing law, the California Consumer Privacy Act of 2020 (CCPA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, requires a consumer, as defined, to have various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about a consumer to third parties to not sell or share the consumers personal information. The act prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information.

This bill would remove the condition that instead prohibit a business from selling or sharing the personal information of a consumer if the business have has actual knowledge that the consumer is less than 16 18 years of age and would revise the above-described prohibition to prohibit a business from selling or sharing the personal information of a consumer over 13 years of age, but less than 18 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information, as specified. The bill would require a business to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.

The CCPA requires the Attorney General to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 16 years of age. The act requires the California Privacy Protection Agency, as specified, to adopt regulations under the authority assigned to the Attorney General under the act.

This bill would instead require the Attorney General to solicit broad public participation and adopt regulations, as described above, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age. The bill would require the California Privacy Protection Agency, on or before July 1, 2025, to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age, and issuing regulations regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age for purposes of the CCPA.

The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020.

Existing law, the California Consumer Privacy Act of 2020 (CCPA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, requires a consumer, as defined, to have various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about a consumer to third parties to not sell or share the consumers personal information. The act prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information.

This bill would remove the condition that the business have actual knowledge that the consumer is less than 16 years of age and would revise the above-described prohibition to prohibit a business from selling or sharing the personal information of a consumer less than 18 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information. information, as specified.

The CCPA requires the Attorney General to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 16 years of age. The act requires the California Privacy Protection Agency, as specified, to adopt regulations under the authority assigned to the Attorney General under the act.

This bill would instead require the Attorney General to solicit broad public participation and adopt regulations, as described above, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age. The bill would require the California Privacy Protection Agency, on or before July 1, 2025, to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age, and issuing regulations regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age for purposes of the CCPA.

The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020.

Existing law, the California Consumer Privacy Act of 2020 (CCPA), approved by the voters as Proposition 24 at the November 3, 2020, statewide general election, requires a consumer, as defined, to have various rights with respect to personal information, as defined, that is collected or sold by a business, as defined, including the right to direct a business that sells or shares personal information about a consumer to third parties to not sell or share the consumers personal information. The act prohibits a business from selling or sharing the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information.

This bill would remove the condition that the business have actual knowledge that the consumer is less than 16 years of age and would revise the above-described prohibition to prohibit a business from selling or sharing the personal information of a consumer less than 18 years of age, unless the consumer, or the consumers parent or guardian, as applicable, has affirmatively authorized the sale or sharing of the consumers personal information.

The CCPA requires the Attorney General to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 16 years of age. The act requires the California Privacy Protection Agency, as specified, to adopt regulations under the authority assigned to the Attorney General under the act.

This bill would require the California Privacy Protection Agency, on or before July 1, 2025, to solicit broad public participation and adopt regulations, as specified, to further the purposes of the act, including, but not limited to, issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumers parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age, and issuing regulations regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age for purposes of the CCPA.

The California Consumer Privacy Act of 2020 authorizes the Legislature to amend the act to further the purposes and intent of the act by a majority vote of both houses of the Legislature, as specified.

This bill would declare that its provisions further the purposes and intent of the California Consumer Privacy Act of 2020.

GOVERNOR'S VETO

GV Bill Id:AB 1949

Author:(Wicks)

As Enrolled Ver:September 3, 2024

2/3 vote

SUMMARY

Amends the California Consumer Privacy Act (CCPA) to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer's parent or guardian if under 13, affirmatively authorizes the collection.

Senate Amendments

1. Provide that the bill's prohibitions against the collection, sale or sharing, and use and disclosure of data apply if the business has "actual knowledge" that a consumer is less than age 18, unless affirmative authorization has been given by the consumer or consumer's parent or guardian, as specified.
2. Require that a business treats a consumer as a minor if they receive a signal through a platform, mechanism or technology indicating that the consumer is, in fact, a minor.
3. Remove the requirement that the Privacy Protection Agency promulgate regulations.

Governor's Veto Message

This bill would amend the California Consumer Privacy Act (CCPA) to prohibit sale, sharing, disclosure, or use of minors' personal information, unless the minor's parent or guardian (for those under 13) or the minor themselves (for those aged 13-18) consents.

I thank the author for her demonstrated commitment to ensuring children's well-being and safety online. I previously signed AB 2273 (Wicks, 2023), the Age-Appropriate Design Code Act, which would have required businesses to address children's privacy as part of a comprehensive approach to designing online products and services for use by minors. I continue to support thoughtful approaches to protect minors and limit the collection and use of their personal information, while ensuring they are able to avail themselves of the benefits of internet use.

However, this bill would fundamentally alter the structure of the CCPA to require businesses, at the point of collection, to distinguish between consumers who are adults and minors. I am concerned that making such a significant change to the CCPA would have unanticipated and potentially adverse effects on how businesses and consumers interact with each other, with unclear effects on children's privacy.

COMMENTS

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civil Code Section 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the CPPA (Privacy Agency). The CCPA has special protections for children the business has actual knowledge are under 16 years old, prohibiting the selling or sharing of their information without affirmative authorization, as provided.

This bill raises the age to anyone under 18 years old. This bill also prohibits a business from collecting, using, or disclosing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the business receives affirmative authorization, as provided. It also requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. This ensures that any consumer can take advantage of the enhanced CCPA protections for minors by transmitting such a signal.

According to the Author

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

While existing federal and state privacy laws offer important protections that guard children's privacy, California's groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.

Arguments in Support

Attorney General Bonta argues in support of the bill:

Growing evidence shows not only that social media usage has a negative impact on children, but that businesses continue to collect children's data and use it to facilitate the algorithmic delivery of content and drive up company profits. On October 24, 2023 Attorney General Bonta and a bipartisan coalition of 33 attorneys general filed a federal complaint against Meta Platforms, Inc. and affiliates (Meta), alleging that the company (which owns Facebook and Instagram) is violating various federal and state privacy and consumer protection laws. The complaint revealed that Meta knows that its social media platforms are used by millions of children under 13, including, at one point, around 30% of all 10 to 12-year-olds, and unlawfully collects their personal information. Meta does this despite Mark Zuckerberg's testimony before Congress in 2021 that Meta "kicks off" children under 13.

In California, the CCPA secures increased privacy rights for consumers, including the right to know what personal information businesses collect and sell, and the right to stop those sales to third parties. With respect to young users, CCPA prohibits businesses from selling the personal information of a child that they know to be under the age of 16 if they get affirmative authorization ("opt-in") for the sale of the child's personal information.

These protections, however, still fail to cover 17-year-old users, and the law does not adequately limit businesses from collecting and exploiting the data of children, so long as they do not sell it. These gaps in the law have, among other things, allowed companies like Google and Meta to collect, exploit, and profit off of children's data on a massive scale.

The California Privacy Protection Agency writes:

Increasing the scope of protections for children encourages consistency with other state laws. Over a dozen states have followed California's footsteps in adopting comprehensive consumer privacy laws. All of them require consent for the collection, use, and disclosure of the personal information of children, similar to the federal children's privacy law, the Children's Online Privacy Protection Act (COPPA), and its implementing regulations. And several states have broadened their protections beyond children under 13 to include children and teens under 18 as well. For example, an amendment to the Connecticut privacy law, which will go into full effect on October 1, 2024, will raise the age of a "minor" to under 18 years of age, among other protections. Colorado adopted a similar bill that raises the age of a "minor" to under 18 years of age and applies the actual knowledge standard to controllers.

The Agency also appreciates recent amendments to the bill that retain the CCPA's actual knowledge standard for determining who is a child for the purposes of the CCPA. Earlier versions of the bill sought to remove the CCPA's actual knowledge standard; however, this could have incentivized businesses to collect additional information to determine who is a child.

Arguments in Opposition

A coalition, including the California Chamber of Commerce, TechNet, and the California Retailers Association, argue in opposition to the bill:

California's landmark data privacy law, the CCPA, is the result of deliberate policy choices and tradeoffs made between competing consumer privacy rights and business interests. Notably for this bill, in passing AB 375 (Chau & Hertzberg, Ch. 55, Stats. 2018) in 2018, the Legislature rejected a competing ballot initiative proposal which would have treated children's PI as a subcategory of the parent's PI, in favor of a legal construct that instead reflects all of the following principles: (1) a child's PI belongs to the child, not their parent; (2) younger minors face greater vulnerabilities and have significant cognitive differences when compared to 16- and 17-year-olds, warranting greater protections, consistent with other federal and state online privacy laws (e.g. Children's Online Privacy Protection Act; Privacy Rights for California Minors in the Digital World); (3) at various ages, minors develop the capacity to exercise various rights independent of their parents as demonstrated, for example, in medical privacy laws ; and (4) the greatest risk posed to consumer data privacy rights arises from disclosures made from one entity (with which the consumer interacts), to another.

As a result of such policy choices implicitly embedded into AB 375, the CCPA was crafted to require businesses to receive authorization from a parent or guardian prior to selling the PI of a child under the age of 13, while affording younger teens (13-, 14- and 15-year-olds) the ability to exercise their own opt-in rights, and granting older teens approaching the age of majority (16- and 17-year-olds) the same rights as 18-year-olds. This has the effect of protecting the most vulnerable children (under the age of 16) against the type of processing that posed the most risk (selling data to, or sharing data with, other entities), while effectively creating a ladder for minors that allowed them to gradually understand and assert their rights before turning the age of majority and while still under the supervision of their parent or guardian.

AB 1949 upsets that balance by now treating older teens the same as younger ones, and by expanding the requirements to obtain affirmative authorization (i.e., consent) for any sale or sharing of minors' PI, as well as any collection, use, or disclosure of the minors' PI. This imbalance is exacerbated by removing the actual knowledge standard (see comment below) and requiring a business to obtain consent prior to collecting, using, or disclosing the PI of a consumer who is under 18-years of age, and not just the PI collected from the consumer. Meaning, for example, that any time a parent names their child as a beneficiary or provides the child's PI to receive any benefits, the business will need the consent of their child if the child is at least 13 but under 18 years of age for even the act of collecting the child's name. By way of another example, consider any time a grandparent signs up their grandchild under 18 as their life insurance beneficiary, or an insurance company receives the name of a 16- or 17-year-old employee or driver as part of a worker's comp claim or accident claim. The insurance company will have to obtain the consent of the 16- or 17-year-old before they so much as accept the claim to avoid violating the law. Such a standard is wildly impractical, if not nearly impossible, to implement.

FISCAL COMMENTS

According to the Senate Appropriations Committee:

1. Unknown, potentially significant cost pressure to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate additional claims of violations of this bill. Existing law establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. The fiscal impact of this bill to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if parties settle the matter before the filing of an action, and the factors unique to each case. An eight hour court day costs approximately $8,000 in staff in workload. If the bill results in only 12 or more days spent in court, trial court costs could be in the hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations. The Budget Act of 2024, for the fiscal year beginning July 1, 2024, includes a $97 million reduction to the trial courts, a commensurate reduction of up to 7.95 percent to the budget for the state-level judiciary, and a reduction of the trial court state-level emergency reserve in the Trial Court Trust Fund from $10 million to $5 million. The Budget Act also includes a $37.3 million General Fund backfill for the Trial Court Trust Fund to address the continued decline in civil fee and criminal fine and penalty revenues expected in fiscal year 2024‒25.
2. The California Privacy Protection Agency (CPPA) indicates minor and absorbable costs.
3. Unknown potential costs to the Department of Justice (DOJ) (General Fund, Unfair Competition Fund) for the increased workload associated with investigating and prosecuting of violations of the requirements of this bill.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 8-0-3

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ABS, ABST OR NV: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

ABS, ABST OR NV: Sanchez, Dixon, Jim Patterson, Ta

ASSEMBLY FLOOR: 58-0-22

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Garcia, Gipson, Grayson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

ABS, ABST OR NV: Alanis, Cervantes, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Friedman, Gabriel, Gallagher, Holden, Hoover, Lackey, Mathis, Jim Patterson, Joe Patterson, Luz Rivas, Sanchez, Ta, Wallis

SENATE FLOOR: 33-0-7

YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Laird, McGuire, Menjivar, Min, Newman, Niello, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

ABS, ABST OR NV: Alvarado-Gil, Dahle, Jones, Limón, Nguyen, Ochoa Bogh, Seyarto

ASSEMBLY FLOOR: 60-0-19

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Friedman, Gabriel, Garcia, Gipson, Grayson, Haney, Hart, Holden, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Pacheco, Papan, Joe Patterson, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Luz Rivas, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Robert Rivas

ABS, ABST OR NV: Alanis, Bains, Cervantes, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Gallagher, Hoover, Lackey, Mathis, Ortega, Jim Patterson, Sanchez, Ta, Wallis, Zbur

UPDATED

VERSION: September 3, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0005196

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1949

Author:(Wicks)

As Amended Ver:July 3, 2024

Majority vote

SUMMARY

Amends the California Consumer Privacy Act (CCPA) to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer's parent or guardian if under 13, affirmatively authorizes the collection.

Senate Amendments

1. Provide that the bill's prohibitions against the collection, sale or sharing, and use and disclosure of data apply if the business has "actual knowledge" that a consumer is less than age 18, unless affirmative authorization has been given by the consumer or consumer's parent or guardian, as specified.
2. Require that a business treats a consumer as a minor if they receive a signal through a platform, mechanism or technology indicating that the consumer is, in fact, a minor.
3. Remove the requirement that the Privacy Protection Agency promulgate regulations.

COMMENTS

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civil Code Section 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the CPPA (Privacy Agency). The CCPA has special protections for children the business has actual knowledge are under 16 years old, prohibiting the selling or sharing of their information without affirmative authorization, as provided.

This bill raises the age to anyone under 18 years old. This bill also prohibits a business from collecting, using, or disclosing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the business receives affirmative authorization, as provided. It also requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. This ensures that any consumer can take advantage of the enhanced CCPA protections for minors by transmitting such a signal.

According to the Author

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

While existing federal and state privacy laws offer important protections that guard children's privacy, California's groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.

Arguments in Support

Attorney General Bonta argues in support of the bill:

Growing evidence shows not only that social media usage has a negative impact on children, but that businesses continue to collect children's data and use it to facilitate the algorithmic delivery of content and drive up company profits. On October 24, 2023 Attorney General Bonta and a bipartisan coalition of 33 attorneys general filed a federal complaint against Meta Platforms, Inc. and affiliates (Meta), alleging that the company (which owns Facebook and Instagram) is violating various federal and state privacy and consumer protection laws. The complaint revealed that Meta knows that its social media platforms are used by millions of children under 13, including, at one point, around 30% of all 10 to 12-year-olds, and unlawfully collects their personal information. Meta does this despite Mark Zuckerberg's testimony before Congress in 2021 that Meta "kicks off" children under 13.

In California, the CCPA secures increased privacy rights for consumers, including the right to know what personal information businesses collect and sell, and the right to stop those sales to third parties. With respect to young users, CCPA prohibits businesses from selling the personal information of a child that they know to be under the age of 16 if they get affirmative authorization ("opt-in") for the sale of the child's personal information.

These protections, however, still fail to cover 17-year-old users, and the law does not adequately limit businesses from collecting and exploiting the data of children, so long as they do not sell it. These gaps in the law have, among other things, allowed companies like Google and Meta to collect, exploit, and profit off of children's data on a massive scale.

The California Privacy Protection Agency writes:

Increasing the scope of protections for children encourages consistency with other state laws. Over a dozen states have followed California's footsteps in adopting comprehensive consumer privacy laws. All of them require consent for the collection, use, and disclosure of the personal information of children, similar to the federal children's privacy law, the Children's Online Privacy Protection Act (COPPA), and its implementing regulations. And several states have broadened their protections beyond children under 13 to include children and teens under 18 as well. For example, an amendment to the Connecticut privacy law, which will go into full effect on October 1, 2024, will raise the age of a "minor" to under 18 years of age, among other protections. Colorado adopted a similar bill that raises the age of a "minor" to under 18 years of age and applies the actual knowledge standard to controllers.

The Agency also appreciates recent amendments to the bill that retain the CCPA's actual knowledge standard for determining who is a child for the purposes of the CCPA. Earlier versions of the bill sought to remove the CCPA's actual knowledge standard; however, this could have incentivized businesses to collect additional information to determine who is a child.

Arguments in Opposition

A coalition, including the California Chamber of Commerce, TechNet, and the California Retailers Association, argue in opposition to the bill:

California's landmark data privacy law, the CCPA, is the result of deliberate policy choices and tradeoffs made between competing consumer privacy rights and business interests. Notably for this bill, in passing AB 375 (Chau & Hertzberg, Ch. 55, Stats. 2018) in 2018, the Legislature rejected a competing ballot initiative proposal which would have treated children's PI as a subcategory of the parent's PI, in favor of a legal construct that instead reflects all of the following principles: (1) a child's PI belongs to the child, not their parent; (2) younger minors face greater vulnerabilities and have significant cognitive differences when compared to 16- and 17-year-olds, warranting greater protections, consistent with other federal and state online privacy laws (e.g. Children's Online Privacy Protection Act; Privacy Rights for California Minors in the Digital World); (3) at various ages, minors develop the capacity to exercise various rights independent of their parents as demonstrated, for example, in medical privacy laws ; and (4) the greatest risk posed to consumer data privacy rights arises from disclosures made from one entity (with which the consumer interacts), to another.

As a result of such policy choices implicitly embedded into AB 375, the CCPA was crafted to require businesses to receive authorization from a parent or guardian prior to selling the PI of a child under the age of 13, while affording younger teens (13-, 14- and 15-year-olds) the ability to exercise their own opt-in rights, and granting older teens approaching the age of majority (16- and 17-year-olds) the same rights as 18-year-olds. This has the effect of protecting the most vulnerable children (under the age of 16) against the type of processing that posed the most risk (selling data to, or sharing data with, other entities), while effectively creating a ladder for minors that allowed them to gradually understand and assert their rights before turning the age of majority and while still under the supervision of their parent or guardian.

AB 1949 upsets that balance by now treating older teens the same as younger ones, and by expanding the requirements to obtain affirmative authorization (i.e., consent) for any sale or sharing of minors' PI, as well as any collection, use, or disclosure of the minors' PI. This imbalance is exacerbated by removing the actual knowledge standard (see comment below) and requiring a business to obtain consent prior to collecting, using, or disclosing the PI of a consumer who is under 18-years of age, and not just the PI collected from the consumer. Meaning, for example, that any time a parent names their child as a beneficiary or provides the child's PI to receive any benefits, the business will need the consent of their child if the child is at least 13 but under 18 years of age for even the act of collecting the child's name. By way of another example, consider any time a grandparent signs up their grandchild under 18 as their life insurance beneficiary, or an insurance company receives the name of a 16- or 17-year-old employee or driver as part of a worker's comp claim or accident claim. The insurance company will have to obtain the consent of the 16- or 17-year-old before they so much as accept the claim to avoid violating the law. Such a standard is wildly impractical, if not nearly impossible, to implement.

FISCAL COMMENTS

According to the Senate Appropriations Committee:

1. Unknown, potentially significant cost pressure to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate additional claims of violations of this bill. Existing law establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. The fiscal impact of this bill to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if parties settle the matter before the filing of an action, and the factors unique to each case. An eight hour court day costs approximately $8,000 in staff in workload. If the bill results in only 12 or more days spent in court, trial court costs could be in the hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations. The Budget Act of 2024, for the fiscal year beginning July 1, 2024, includes a $97 million reduction to the trial courts, a commensurate reduction of up to 7.95 percent to the budget for the state-level judiciary, and a reduction of the trial court state-level emergency reserve in the Trial Court Trust Fund from $10 million to $5 million. The Budget Act also includes a $37.3 million General Fund backfill for the Trial Court Trust Fund to address the continued decline in civil fee and criminal fine and penalty revenues expected in fiscal year 2024‒25.
2. The California Privacy Protection Agency (CPPA) indicates minor and absorbable costs.
3. Unknown potential costs to the Department of Justice (DOJ) (General Fund, Unfair Competition Fund) for the increased workload associated with investigating and prosecuting of violations of the requirements of this bill.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 8-0-3

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ABS, ABST OR NV: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

ABS, ABST OR NV: Sanchez, Dixon, Jim Patterson, Ta

ASSEMBLY FLOOR: 58-0-22

YES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Garcia, Gipson, Grayson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

ABS, ABST OR NV: Alanis, Cervantes, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Friedman, Gabriel, Gallagher, Holden, Hoover, Lackey, Mathis, Jim Patterson, Joe Patterson, Luz Rivas, Sanchez, Ta, Wallis

SENATE FLOOR: 33-0-7

YES: Allen, Archuleta, Ashby, Atkins, Becker, Blakespear, Bradford, Caballero, Cortese, Dodd, Durazo, Eggman, Glazer, Gonzalez, Grove, Hurtado, Laird, McGuire, Menjivar, Min, Newman, Niello, Padilla, Portantino, Roth, Rubio, Skinner, Smallwood-Cuevas, Stern, Umberg, Wahab, Wiener, Wilk

ABS, ABST OR NV: Alvarado-Gil, Dahle, Jones, Limón, Nguyen, Ochoa Bogh, Seyarto

UPDATED

VERSION: July 3, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0004970

 THIRD READING  

Bill No: AB 1949

Author: Wicks (D), et al.

Amended: 7/3/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/2/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

SENATE APPROPRIATIONS COMMITTEE: 4-1, 8/15/24

AYES: Caballero, Ashby, Becker, Wahab

NOES: Jones

NO VOTE RECORDED: Bradford, Seyarto

ASSEMBLY FLOOR: 58-0, 5/21/24 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2020: collection of personal information of a consumer less than 18 years of age

SOURCE: California Department of Justice

DIGEST:

This bill prohibits collecting, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. This bill requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act of 2020 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civil (Civ.) Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b))
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c))
4. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a))
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v)) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae))
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020))
7. Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70)
8. Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a))
9. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020))

This bill:

1. Prohibits a business from collecting, using, disclosing, selling, or sharing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 18 years of age, or the consumer’s parent or guardian, in the case of a consumer less than 13 years of age, has affirmatively authorized the collection of the consumer’s personal information. This bill clarifies that this does not prohibit short-term, transient use of personal information that is necessary and proportional to the purpose for which it is used, and is not used, disclosed, or retained for any other purpose, including to build a profile regarding the consumer.
2. Raises the age of consumers for whom regulations that must be promulgated by the Attorney General to allow for an opt-out preference signal shall apply.
3. Requires a business to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.
4. States that the Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civil Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA. The CCPA has special protections for children the business has actual knowledge are under 16 years old, prohibiting the selling or sharing of their information without affirmative authorization, as provided.

This bill raises the age to anyone under 18 years old. This bill also prohibits a business from collecting, using, or disclosing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the business receives affirmative authorization, as provided. It also requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. This ensures that any consumer can take advantage of the enhanced CCPA protections for minors by transmitting such a signal. For a more thorough assessment of the bill, see the Senate Judiciary Committee analysis.

Comments

According to the author, “According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

“In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

“While existing federal and state privacy laws offer important protections that guard children’s privacy, California’s groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.”

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Unknown, potentially significant cost pressure to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate additional claims of violations of this bill. Existing law establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. The fiscal impact of this bill to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if parties settle the matter before the filing of an action, and the factors unique to each case. An eight hour court day costs approximately $8,000 in staff in workload. If the bill results in only 12 or more days spent in court, trial court costs could be in the hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations. The Budget Act of 2024, for the fiscal year beginning July 1, 2024, includes a $97 million reduction to the trial courts, a commensurate reduction of up to 7.95 percent to the budget for the state-level judiciary, and a reduction of the trial court state-level emergency reserve in the Trial Court Trust Fund from $10 million to $5 million. The Budget Act also includes a $37.3 million General Fund backfill for the Trial Court Trust Fund to address the continued decline in civil fee and criminal fine and penalty revenues expected in fiscal year 2024‒25.
• The California Privacy Protection Agency (PPA) indicates minor and absorbable costs.
• Unknown potential costs to the Department of Justice (DOJ) (General Fund, Unfair Competition Fund) for the increased workload associated with investigating and prosecuting of violations of the requirements of this bill.

SUPPORT: (Verified 8/28/24)

California Department of Justice (source)

ACLU California Action

Children’s Advocacy Institute

Cleanearth4kids.org

Consumer Watchdog

Democrats for Israel - CA

Democrats for Israel Los Angeles

Etta

Hadassah

Holocaust Museum LA

Jewish Big Brothers Big Sisters of Los Angeles

Jewish Center for Justice

Jewish Democratic Club of Marin

Jewish Democratic Club of Solano County

Jewish Democratic Coalition of the Bay Area

Jewish Family and Children's Service of Long Beach and Orange County

Jewish Family and Children's Services of San Francisco, the Peninsula, Marin and Sonoma Counties

Jewish Family Service of Los Angeles

Jewish Family Service of the Desert

Jewish Family Services of Silicon Valley

Jewish Federation of Greater Los Angeles, the

Jewish Federation of the Greater San Gabriel and Pomona Valleys

Jewish Long Beach

Jewish Public Affairs Committee

Jewish Silicon Valley

Perk Advocacy

Progressive Zionists of California

OPPOSITION: (Verified 8/28/24)

American Property Casualty Insurance Association

California Bankers Association

California Chamber of Commerce

California Retailers Association

Civil Justice Association of California

Computer & Communications Industry Association

Insights Association

Oakland Privacy

Software & Information Industry Association

TechNet

4 Individuals

ARGUMENTS IN SUPPORT: Consumer Watchdog states:

Consumer Watchdog wholeheartedly supports any efforts to implement a more fulsome “opt-in” system of privacy regulation, which is the system most commonly used outside the United States, such as by the European Union through its General Data Protection Regulation. The CCPA currently requires that businesses obtain opt-ins to sell or share children’s data, but only if the business has “actual knowledge” that the data in question is a child’s data. This bill expands that right by requiring that businesses obtain affirmative authorization before not only sharing or selling, but also collecting, using, or disclosing the personal information of a minor, while also removing the “actual knowledge” limiting language.

Ultimately, this is a matter of personal rights and liberties. Children today are continually having their personal information collected and processed in order to better profile them for targeted advertising. As you have previously noted: “By the time a child is 13 years old, online advertising firms have collected an average of 72 million data points about them.” Passing AB 1949 is a critical step towards ensuring Californians have the opportunity to “pursue and obtain privacy” as adults without having unknowingly forfeited that right as children.

ARGUMENTS IN OPPOSITION: A coalition of industry groups, including the California Chamber of Commerce and Technet, write:

As a result of such policy choices implicitly embedded into AB 375, the CCPA was crafted to require businesses to receive authorization from a parent or guardian prior to selling the PI of a child under the age of 13, while affording younger teens (13-, 14- and 15-year-olds) the ability to exercise their own opt-in rights, and granting older teens approaching the age of majority (16- and 17-year-olds) the same rights as 18-year-olds. This has the effect of protecting the most vulnerable children (under the age of 16) against the type of processing that posed the most risk (selling data to, or sharing data with, other entities), while effectively creating a ladder for minors that allowed them to gradually understand and assert their rights before turning the age of majority and while still under the supervision of their parent or guardian.

AB 1949 upsets that balance by now treating older teens the same as younger ones, and by expanding the requirements to obtain affirmative authorization (i.e., consent) for any sale or sharing of minors’ PI, as well as any collection, use, or disclosure of the minors’ PI.

ASSEMBLY FLOOR: 58-0, 5/21/24

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Garcia, Gipson, Grayson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Alanis, Cervantes, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Friedman, Gabriel, Gallagher, Holden, Hoover, Lackey, Mathis, Jim Patterson, Joe Patterson, Luz Rivas, Sanchez, Ta, Wallis

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/28/24 10:07:13

**** END ****

 THIRD READING  

Bill No: AB 1949

Author: Wicks (D), et al.

Amended: 7/3/24 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 11-0, 7/2/24

AYES: Umberg, Wilk, Allen, Ashby, Caballero, Durazo, Laird, Niello, Roth, Stern, Wahab

SENATE APPROPRIATIONS COMMITTEE: 4-1, 8/15/24

AYES: Caballero, Ashby, Becker, Wahab

NOES: Jones

NO VOTE RECORDED: Bradford, Seyarto

ASSEMBLY FLOOR: 58-0, 5/21/24 - See last page for vote

SUBJECT: California Consumer Privacy Act of 2020: collection of personal information of a consumer less than 18 years of age

SOURCE: California Department of Justice

DIGEST:

This bill prohibits collecting, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. This bill requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.

ANALYSIS:

Existing law:

1. Establishes the California Consumer Privacy Act of 2020 (CCPA), which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civil (Civ.) Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b))
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c))
4. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a))
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v)) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae))
6. Establishes the California Privacy Rights Act of 2020 (CPRA), which amends the CCPA and creates the California Privacy Protection Agency (PPA), which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020))
7. Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70)
8. Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a))
9. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020))

This bill:

1. Prohibits a business from collecting, using, disclosing, selling, or sharing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 18 years of age, or the consumer’s parent or guardian, in the case of a consumer less than 13 years of age, has affirmatively authorized the collection of the consumer’s personal information. This bill clarifies that this does not prohibit short-term, transient use of personal information that is necessary and proportional to the purpose for which it is used, and is not used, disclosed, or retained for any other purpose, including to build a profile regarding the consumer.
2. Raises the age of consumers for whom regulations that must be promulgated by the Attorney General to allow for an opt-out preference signal shall apply.
3. Requires a business to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age.
4. States that the Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.

Background

The CCPA grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civil Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the CPRA. The CPRA amends the CCPA, limits further amendment, and creates the PPA. The CCPA has special protections for children the business has actual knowledge are under 16 years old, prohibiting the selling or sharing of their information without affirmative authorization, as provided.

This bill raises the age to anyone under 18 years old. This bill also prohibits a business from collecting, using, or disclosing the personal information of a consumer the business has actual knowledge is less than 18 years of age, unless the business receives affirmative authorization, as provided. It also requires businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. This ensures that any consumer can take advantage of the enhanced CCPA protections for minors by transmitting such a signal. For a more thorough assessment of the bill, see the Senate Judiciary Committee analysis.

Comments

According to the author, “According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

“In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

“While existing federal and state privacy laws offer important protections that guard children’s privacy, California’s groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.”

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Unknown, potentially significant cost pressure to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate additional claims of violations of this bill. Existing law establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. The fiscal impact of this bill to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if parties settle the matter before the filing of an action, and the factors unique to each case. An eight hour court day costs approximately $8,000 in staff in workload. If the bill results in only 12 or more days spent in court, trial court costs could be in the hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations. The Budget Act of 2024, for the fiscal year beginning July 1, 2024, includes a $97 million reduction to the trial courts, a commensurate reduction of up to 7.95 percent to the budget for the state-level judiciary, and a reduction of the trial court state-level emergency reserve in the Trial Court Trust Fund from $10 million to $5 million. The Budget Act also includes a $37.3 million General Fund backfill for the Trial Court Trust Fund to address the continued decline in civil fee and criminal fine and penalty revenues expected in fiscal year 2024‒25.
• The California Privacy Protection Agency (PPA) indicates minor and absorbable costs.
• Unknown potential costs to the Department of Justice (DOJ) (General Fund, Unfair Competition Fund) for the increased workload associated with investigating and prosecuting of violations of the requirements of this bill.

SUPPORT: (Verified 8/15/24)

California Department of Justice (source)

ACLU California Action

Children’s Advocacy Institute

Cleanearth4kids.org

Consumer Watchdog

Democrats for Israel - CA

Democrats for Israel Los Angeles

Etta

Hadassah

Holocaust Museum LA

Jewish Big Brothers Big Sisters of Los Angeles

Jewish Center for Justice

Jewish Democratic Club of Marin

Jewish Democratic Club of Solano County

Jewish Democratic Coalition of the Bay Area

Jewish Family and Children's Service of Long Beach and Orange County

Jewish Family and Children's Services of San Francisco, the Peninsula, Marin and Sonoma Counties

Jewish Family Service of Los Angeles

Jewish Family Service of the Desert

Jewish Family Services of Silicon Valley

Jewish Federation of Greater Los Angeles, the

Jewish Federation of the Greater San Gabriel and Pomona Valleys

Jewish Long Beach

Jewish Public Affairs Committee

Jewish Silicon Valley

Perk Advocacy

Progressive Zionists of California

OPPOSITION: (Verified 8/15/24)

American Property Casualty Insurance Association

California Chamber of Commerce

California Retailers Association

Civil Justice Association of California

Computer & Communications Industry Association

Insights Association

Oakland Privacy

Software & Information Industry Association

TechNet

4 Individuals

ARGUMENTS IN SUPPORT: Consumer Watchdog states:

Consumer Watchdog wholeheartedly supports any efforts to implement a more fulsome “opt-in” system of privacy regulation, which is the system most commonly used outside the United States, such as by the European Union through its General Data Protection Regulation. The CCPA currently requires that businesses obtain opt-ins to sell or share children’s data, but only if the business has “actual knowledge” that the data in question is a child’s data. This bill expands that right by requiring that businesses obtain affirmative authorization before not only sharing or selling, but also collecting, using, or disclosing the personal information of a minor, while also removing the “actual knowledge” limiting language.

Ultimately, this is a matter of personal rights and liberties. Children today are continually having their personal information collected and processed in order to better profile them for targeted advertising. As you have previously noted: “By the time a child is 13 years old, online advertising firms have collected an average of 72 million data points about them.” Passing AB 1949 is a critical step towards ensuring Californians have the opportunity to “pursue and obtain privacy” as adults without having unknowingly forfeited that right as children.

ARGUMENTS IN OPPOSITION: A coalition of industry groups, including the California Chamber of Commerce and Technet, write:

As a result of such policy choices implicitly embedded into AB 375, the CCPA was crafted to require businesses to receive authorization from a parent or guardian prior to selling the PI of a child under the age of 13, while affording younger teens (13-, 14- and 15-year-olds) the ability to exercise their own opt-in rights, and granting older teens approaching the age of majority (16- and 17-year-olds) the same rights as 18-year-olds. This has the effect of protecting the most vulnerable children (under the age of 16) against the type of processing that posed the most risk (selling data to, or sharing data with, other entities), while effectively creating a ladder for minors that allowed them to gradually understand and assert their rights before turning the age of majority and while still under the supervision of their parent or guardian.

AB 1949 upsets that balance by now treating older teens the same as younger ones, and by expanding the requirements to obtain affirmative authorization (i.e., consent) for any sale or sharing of minors’ PI, as well as any collection, use, or disclosure of the minors’ PI.

ASSEMBLY FLOOR: 58-0, 5/21/24

AYES: Addis, Aguiar-Curry, Alvarez, Arambula, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Juan Carrillo, Wendy Carrillo, Connolly, Mike Fong, Garcia, Gipson, Grayson, Haney, Hart, Irwin, Jackson, Jones-Sawyer, Kalra, Lee, Low, Lowenthal, Maienschein, McCarty, McKinnor, Muratsuchi, Stephanie Nguyen, Ortega, Pacheco, Papan, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Rendon, Reyes, Rodriguez, Blanca Rubio, Santiago, Schiavo, Soria, Ting, Valencia, Villapudua, Waldron, Ward, Weber, Wicks, Wilson, Wood, Zbur, Robert Rivas

NO VOTE RECORDED: Alanis, Cervantes, Chen, Megan Dahle, Davies, Dixon, Essayli, Flora, Vince Fong, Friedman, Gabriel, Gallagher, Holden, Hoover, Lackey, Mathis, Jim Patterson, Joe Patterson, Luz Rivas, Sanchez, Ta, Wallis

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/16/24 12:47:33

**** END ****

SENATE COMMITTEE ON

Senator Anna Caballero, Chair

2023 - 2024 Regular Session

AB 1949 (Wicks) - California Consumer Privacy Act of 2020: collection of personal information of a consumer less than 18 years of age

Bill Summary:

AB 1949 would limit a business’s ability to collect and disclose a child’s personal information under the California Consumer Privacy Act (CCPA).

Fiscal Impact:

• Unknown, potentially significant cost pressure to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate additional claims of violations of this bill. Existing law establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. The fiscal impact of this bill to the courts will depend on many unknown factors, including the numbers of violations alleged to have occurred, if parties settle the matter before the filing of an action, and the factors unique to each case. An eight hour court day costs approximately $8,000 in staff in workload. If the bill results in only 12 or more days spent in court, trial court costs could be in the hundreds of thousands of dollars. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations. The Budget Act of 2024, for the fiscal year beginning July 1, 2024, includes a $97 million reduction to the trial courts, a commensurate reduction of up to 7.95 percent to the budget for the state-level judiciary, and a reduction of the trial court state-level emergency reserve in the Trial Court Trust Fund from $10 million to $5 million. The Budget Act also includes a $37.3 million General Fund backfill for the Trial Court Trust Fund to address the continued decline in civil fee and criminal fine and penalty revenues expected in fiscal year 2024‒25.
  
• The California Privacy Protection Agency (PPA) indicates minor and absorbable costs.
• Unknown potential costs to the Department of Justice (DOJ) (General Fund, Unfair Competition Fund) for the increased workload associated with investigating and prosecuting of violations of the requirements of this bill.

Background:

Generally, the CCPA prohibits a business from “collecting and selling” the personal information of a user who is under the age of 16 if the business has actual knowledge that the consumer is less than 16 years old. This prohibition applies unless a user over the age of 13, or the parent of a user under the age of 13, opts into the sale of the user’s data.

Proposed Law:

This bill makes two notable changes to the CCPA. First, it prohibits a business from collecting, using, or disclosing (not just selling) the personal information of a user under 18 years of age unless the user (or in the case of a user younger than 13 years old, the user’s parent or guardian) affirmatively authorizes its collection. Second, this bill removes the “actual knowledge” standard in the Act, and instead prohibits a business from selling or sharing the personal information of users under 18, unless the business receives prior authorization from the user or their parent or guardian. Specifically, this bill provides that a business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

This bill also requires the PPA to establish an age verification system capable of determining when a business must treat a consumer as being under 13 or under 18. PPA has indicated that the costs of promulgating the required regulations is minor and absorbable.

Related Legislation:

AB 2877 (Bauer-Kahan) would prohibits developers of AI systems or tools from using the personal information of children under 16 to train AI systems or services without first obtaining affirmative authorization. AB 2877 is pending in this Committee.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2023-2024 Regular Session

Bill No: AB 1949 (Author:Wicks)

Version: April 4, 2024

Hearing Date: July 2, 2024

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

California Consumer Privacy Act of 2020: collection of personal information of a consumer less than 18 years of age

DIGEST

This bill prohibits collecting, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. The bill provides for regulations to be promulgated by the California Privacy Protection Agency (PPA).

EXECUTIVE SUMMARY

The California Consumer Privacy Act (CCPA) grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale or sharing of information; and protection from discrimination for exercising these rights. (Civ. Code § 1798.100 et seq.) In the November 3, 2020 election, voters approved Proposition 24, which established the California Privacy Rights Act of 2020 (CPRA). The CPRA amends the CCPA, limits further amendment, and creates the PPA. The CCPA has special protections for children the business has actual knowledge are under 16 years old, prohibiting the selling or sharing of their information without affirmative authorization, as provided.

This bill removes the actual knowledge standard in this provision and raises the age to anyone under 18 years old. The bill also prohibits a business from collecting, using, or disclosing the personal information of a consumer less than 18 years of age, unless the business receives affirmative authorization, as provided.

The bill is supported by various organizations including Consumer Watchdog and the Children’s Advocacy Institute. It is opposed by industry associations and privacy and civil liberties groups, including the California Retailers Association and Privacy Rights Clearinghouse.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
2. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b).)
3. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
4. Provides that the obligations imposed by the CCPA shall not restrict a business’s ability to carry out certain conduct, including complying with federal, state, or local laws or to cooperate with law enforcement. This also includes cooperating with a government agency’s request for emergency access to a consumer’s personal information if a natural person is at risk or danger of death or serious physical injury where certain circumstances are met. (Civ. Code § 1798.145(a).)
5. Defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. The CCPA provides a nonexclusive series of categories of information deemed to be personal information, including identifiers, biometric information, and geolocation data. (Civ. Code § 1798.140(v).) The CCPA defines and provides additional protections for sensitive personal information, as defined, that reveals specified personal information about consumers. (Civ. Code § 1798.140(ae).)
6. Establishes the CPRA, which amends the CCPA and creates the PPA, which is charged with implementing these privacy laws, promulgating regulations, and carrying out enforcement actions. (Civ. Code § 798.100 et seq.; Proposition 24 (2020).)
7. Provides that administrative actions to enforce the CCPA must be brought by the PPA within five years after the date on which the underlying violation occurred. (Civ. Code § 1798.199.70.)
8. Establishes civil penalties for CCPA violations, to be recovered through a civil action brought on behalf of the people of the state of California by the Attorney General. (Civ. Code § 1798.199.90(a).)
9. Permits amendment of the CPRA by a majority vote of each house of the Legislature and the signature of the Governor, provided such amendments are consistent with and further the purpose and intent of this act as set forth therein. (Proposition 24 § 25 (2020).)

This bill:

1. Prohibits a business from collecting, using, disclosing, selling, or sharing the personal information of a consumer less than 18 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 18 years of age, or the consumer’s parent or guardian, in the case of a consumer less than 13 years of age, has affirmatively authorized the collection of the consumer’s personal information. The bill clarifies that this does not prohibit short-term, transient use of personal information that is necessary and proportional to the purpose for which it is used, and is not used, disclosed, or retained for any other purpose, including to build a profile regarding the consumer.
2. Raises the age of consumers for whom regulations that must be promulgated by the Attorney General to allow for an opt-out preference signal shall apply.
3. Requires, on or before July 1, 2025, the PPA to solicit broad public participation and adopt regulations to further the purposes of the CCPA, including, but not limited to:
   1. Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 18 years of age.
   2. Issuing regulations regarding age verification and when a business must treat a consumer as being less than 13 or 18 years of age for purposes of this title.
4. States that the Legislature finds and declares that this act furthers the purposes and intent of The California Privacy Rights Act of 2020.

COMMENTS

1. California’s landmark privacy protection law

As stated, the CCPA grants consumers certain rights with regard to their personal information, as defined. With passage of the CPRA in 2020, the CCPA got an overhaul. Consumers are afforded the right to receive notice from businesses at the point of collection of personal information and the right to access that information at any time. The CCPA also grants a consumer the right to request that a business delete any personal information about the consumer the business has collected from the consumer. However, a business is not required to comply with such a request to delete if it is necessary for the business to maintain the consumer’s personal information in order to carry out certain obligations or other conduct.

The CCPA provides adult consumers the right, at any time, “to direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information. This right may be referred to as the right to opt-out.” Changes made by the CPRA extend this to opting out of the “sharing” of the personal information as well. A business is thereafter prohibited from selling (or sharing) that information unless consent is subsequently provided. A business that sells or shares personal information to third parties is required to notify consumers that this information may be sold and that they have the right to opt out of such sales. (Civ. Code § 1798.120(b).) The CPRA added a new category of information, sensitive information, which includes data such as precise geolocation and genetic information. Consumers are additionally empowered to limit businesses’ use of such information.

1. Enhanced protections for minors

The CCPA currently provides heightened protections for children. If a business has actual knowledge that a consumer is less than 16 years of age, it is prohibited from selling or sharing the child’s personal information, with one exception. If the business gets affirmative authorization from a child over 13, or the child’s parent or guardian if they are younger than 13 years old, the business can sell or share the child’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.

This bill enhances these protections by moving the age to less than 18 years of age and removing the actual knowledge standard. The bill further prohibits the collection, use, and disclosure of a minor’s personal information without affirmative consent, as provided.

According to the author:

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

While existing federal and state privacy laws offer important protections that guard children’s privacy, California’s groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.

One area that such protections are particularly important in is social media interactions. The negative consequences of social media for children have been well-documented, including encouragement of eating disorders or drug use and severe effects on mental health.^[1] In fact, the problem has become so dire that the United States Surgeon General recently issued a health advisory with respect to social media usage. The effects on mental health are intensified by the algorithms that are used to determine what content to push out to users, even children.^[2] The algorithmic feeds are fueled by a user’s own information and inferences drawn from their past behavior and data collected from other sources. While these features can effectively serve up content curated for users’ personal tastes and create social connections among users, it is these types of features that are most concerning to advocates for reform. The Surgeon General’s report included the following recommendation:

Limit children’s exposure to harmful online content. This can involve a mix of limiting access for younger users, reducing content amplification, prohibiting data collection of and targeted advertising to children, ensuring privacy settings are maximized by default, removing content quickly if it violates company policies, tightening age verification requirements and audits, enabling independent algorithm audits, and imposing consequences for users found to be circumventing age restrictions or other policies.^[3]

Writing in support, Consumer Watchdog states:

Consumer Watchdog wholeheartedly supports any efforts to implement a more fulsome “opt-in” system of privacy regulation, which is the system most commonly used outside the United States, such as by the European Union through its General Data Protection Regulation. The CCPA currently requires that businesses obtain opt-ins to sell or share children’s data, but only if the business has “actual knowledge” that the data in question is a child’s data. This bill expands that right by requiring that businesses obtain affirmative authorization before not only sharing or selling, but also collecting, using, or disclosing the personal information of a minor, while also removing the “actual knowledge” limiting language.

Ultimately, this is a matter of personal rights and liberties. Children today are continually having their personal information collected and processed in order to better profile them for targeted advertising. As you have previously noted: “By the time a child is 13 years old, online advertising firms have collected an average of 72 million data points about them.”4 Passing AB 1949 is a critical step towards ensuring Californians have the opportunity to “pursue and obtain privacy” as adults without having unknowingly forfeited that right as children.

1. Concerns with age verification and the standard applied

A number of concerns have been raised by opposition, specifically focused on the removal of the actual knowledge standard and the attendant age verification practices that will be made necessary by the bill.

A coalition of industry groups, including the California Chamber of Commerce and Technet, write:

AB 1949 undermines privacy by striking the CCPA’s knowledge standard and forcing businesses to investigate the age of all consumers.

Currently, under the CCPA, minors under the age of 16 have an “opt-in right” to the sale or sharing of their PI. In furtherance of this right, the CCPA prohibits a business from selling or sharing the PI of a consumer who is less than 16 years of age absent affirmative authorization from either the minor (in the case of minors who are at least 13 years of age and less than 16) or the parent or guardian (in the case of minors who are under 13 years of age). That prohibition, however, applies only “if the business has actual knowledge that the consumer is less than 16 years of age […].” At the same time, to discourage willful ignorance, the CCPA sets forth that “a[ny] business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age.” (See Civ. Code Sec. 1798.120(c), emphasis added.)

AB 1949 not only abandons the CCPA’s actual knowledge standard which was baked into the CCPA’s right to opt-in for minors since its inception in 2018, but it also requires affirmative authorization prior to the collection, use, or disclosure of a minor’s PI regardless of the business having actual knowledge of the consumer’s age. This will have far reaching impacts for all businesses, including brick and mortar stores.

Effectively, AB 1949 would create strict liability any time the business is wrong, even if the business took every reasonable effort to verify the consumer’s age. As such, the bill forces every business covered by the CCPA to collect and validate detailed PI about every consumer entering their physical stores or establishments, or websites – in other words, effectively mandating age verification. Of course, accurately confirming a specific individual’s age requires gathering more granular information on the consumer, which runs counter to data minimization principles. It is also incredibly impractical.

A coalition of privacy and civil liberties groups also write in opposition to the age verification scheme required by this bill:

[B]y directing the California Privacy Protection Agency ("the Agency) to create guidelines for age verification, the bill sets the foundation for a system that would burden all internet users' ability to access information online. EFF strongly opposes age verification schemes, because they harm everyone's First Amendment rights, limit online anonymity, and limit people's ability to access protected speech. Both adults and minors have a First Amendment right to access lawful speech online, including the news, social media, and health websites, without having to provide proof of their age or have that information collected. Moreover, although California has a legitimate interest in protecting children, that interest “does not include a free-floating power to restrict the ideas to which children may be exposed.” Brown v. Ent. Merchants Ass'n, 564 U.S.

786, 794 (2011). Age verification implemented to restrict children generally from accessing online services violate the First Amendment.

Age verification schemes also frustrate everyone's right to remain anonymous online while they access lawful speech. This includes, for example, young people seeking information on issues that may not be supported in their households—LGBTQ+ community support, reproductive care, gender-affirming care—without their parent's knowledge.

Aside from the constitutional problems, age verification schemes create new privacy concerns. Because the purpose of the age-gate is to identify minors v. adults, all minors and adults must pass through and be verified. Doing so sets up a system that necessitates additional data collection from every user—opening up new avenues for security breach or data misuse.

In response to these concerns, the author has agreed to amendments that replace the actual knowledge standard into the various sections of the bill, essentially imposing the restrictions of the bill for only those consumers the business has actual knowledge are under 18 years of age. Similar to the existing opt-out right language for children, a business that willfully disregards the consumer’s age is deemed to have had actual knowledge of the consumer’s age. Furthermore, businesses are required to treat a consumer as under age 18 if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. This shall thus amount to actual knowledge. The amendments remove the requirement for the PPA to promulgate regulations.

This new approach removes the strict liability standard but still ensures children are given enhanced privacy rights in order to avoid the ills outlined above.

SUPPORT

Children’s Advocacy Institute

Cleanearth4kids.org

Consumer Watchdog

Democrats for Israel - CA

Democrats for Israel Los Angeles

Etta

Hadassah

Holocaust Museum LA

Jewish Big Brothers Big Sisters of Los Angeles

Jewish Center for Justice

Jewish Democratic Club of Marin

Jewish Democratic Club of Solano County

Jewish Democratic Coalition of the Bay Area

Jewish Family and Children's Service of Long Beach and Orange County

Jewish Family and Children's Services of San Francisco, the Peninsula, Marin and Sonoma Counties

Jewish Family Service of Los Angeles

Jewish Family Service of the Desert

Jewish Family Services of Silicon Valley

Jewish Federation of Greater Los Angeles, the

Jewish Federation of the Greater San Gabriel and Pomona Valleys

Jewish Long Beach

Jewish Public Affairs Committee

Jewish Silicon Valley

Perk Advocacy

Progressive Zionists of California

OPPOSITION

American Property Casualty Insurance Association

California Chamber of Commerce

California Retailers Association

Civil Justice Association of California

Computer & Communications Industry Association

Electronic Frontier Foundation

Insights Association

Oakland Privacy

Privacy Rights Clearinghouse

Software & Information Industry Association

TechNet

4 Individuals

RELATED LEGISLATION

Pending Legislation:

SB 1223 (Becker, 2024) includes “neural data,” as defined, within the definition of “sensitive personal information” for purposes of the CCPA. SB 1223 is currently in the Assembly Privacy and Consumer Protection Committee.

AB 1824 (Valencia, 2024) requires a business that assumes control of all or some part of a transferor business that includes the transfer of a consumer’s personal information to comply with a consumer’s direction to the transferor pursuant to the CCPA. AB 1824 is currently on the Senate Floor.

AB 2013 (Irwin, 2024) requires developers of AI systems or services that are made available for Californians to use to post on their website documentation regarding the data used to train the system or service, including high-level summaries of the datasets used. AB 2013 is currently in this Committee.

AB 2877 (Bauer-Kahan, 2024) prohibits CCPA covered-businesses that are the developers of AI systems or tools from using the personal information of consumers under the age of 16 to train AI systems or services without first obtaining affirmative authorization, and even with such authorization the data must be de-identified and aggregated before it is used to train. AB 2877 is currently in the Senate Appropriations Committee.

AB 3048 (Lowenthal, 2024) requires that internet browsers include an opt-out preference signal allowing consumers interacting with businesses online to automatically exercise their right to opt-out of the selling and sharing of their personal information. AB 3048 is currently in this Committee.

Prior Legislation:

AB 947 (Gabriel, Ch. 551, Stats. 2023) included personal information that reveals a consumer’s citizenship or immigration status in the definition of “sensitive personal information” for purposes of the CCPA.

AB 1194 (Wendy Carrillo, Ch. 567. Stats. 2023) provided stronger privacy protections pursuant to the CCPA where the consumer information contains information related to accessing, procuring, or searching for services regarding contraception, pregnancy care, and perinatal care, including abortion services.

AB 375 (Chau, Ch. 55, Stats. 2018) established the CCPA.

PRIOR VOTES:

Assembly Floor (Ayes 58, Noes 0)

Assembly Appropriations Committee (Ayes 11, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 8, Noes 0)

**************

1. See Zaheer Hussain and Mark D Griffiths, Problematic Social Networking Site Use and Comorbid Psychiatric Disorders: A Systematic Review of Recent Large-Scale Studies.” (December 14, 2018) Frontiers in psychiatry vol. 9 686, https://www.ncbi.nlm.nih.gov/pmc/articles/PMC6302102/pdf/fpsyt-09-00686.pdf; Jeff Horowitz & Deepa Seetharaman, Facebook Executives Shut Down Efforts to Make the Site Less Divisive (May 26, 2020) Wall Street Journal, https://www.wsj.com/articles/facebook-knows-it-encourages-division-top-executives-nixed-solutions-11590507499. All internet citations are current as of June 20, 2024. ↑

2. See Sheera Frenkel & Cecilia Kang, Mark Zuckerberg and Sheryl Sandberg’s Partnership Did Not Survive Trump (July 8, 2021) The New York Times, https://www.nytimes.com/2021/07/08/business/mark-zuckerberg-sheryl-sandberg-facebook.html; Caroline Atkinson, et al., Recommendations to the Biden Administration On Regulating Disinformation and Other Harmful Content on Social Media (March 2021) Harvard Kennedy School & New York University Stern School of Business, https://static1.squarespace.com/static/5b6df958f8370af3217d4178/t/6058a456ca24454a73370dc8/1616421974691/TechnologyRecommendations_2021final.pdf. ↑

3. U.S. Surgeon General’s Advisory, Social Media and Youth Mental Health (May 23, 2023) https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 1949

Author:(Wicks)

As Amended Ver:April 4, 2024

Majority vote

SUMMARY

Amends the California Consumer Privacy Act (CCPA) to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer's parent or guardian if under 13, affirmatively authorizes the collection.

Major Provisions

1. Prohibits a business subject to the CCPA from collecting, using, or disclosing the personal information of a consumer under 18 years of age unless the consumer, or in the case of a consumer less than 13 years old, the consumer's parent or guardian, affirmatively authorizes its collection.
2. Removes the "actual knowledge" standard in the CCPA and instead prohibits a business from selling or sharing the personal information of consumers less than 18 years of age, unless the business receives prior authorization from the individual or their parent or guardian.
3. Requires that on or before July 1, 2025 the California Privacy Protection Agency (Privacy Agency) solicit broad public participation in the adoptions of regulations that:
   1. Establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer's parents or guardian, to specify that the consumer is under 18 years of age.
   2. Establish an age verification system capable of determining when a business must treat a consumer as being less than 13 or under 18 years old.

COMMENTS

In California, the CCPA secures increased privacy rights for consumers, including the right to know what personal information businesses collect and sell and the right to stop those sales to third parties. With respect to young users, the CCPA prohibits businesses from selling the personal information of a child that they know to be under the age of 16 unless they get affirmative authorization ("opt-in") for the sale of the child's personal information.

How this bill would work. This bill makes two key changes to the CCPA as it pertains to the collection, sharing, and sale of the personal information of children and young people under the age of 18:

1. It removes the "actual knowledge" standard in the law, leaving a strict prohibition against collecting, sharing, or selling the personal information of children under the age of 17 unless the child, or the child's parent or guardian if the child is under 13, provides prior authorization for the business to do so.
2. It increases the current prohibition against selling the personal information of children from 16 years old to include all youth under 18 years old, unless the business receives explicit permission to do so.

Because social media platform operators primarily earn revenue through digital advertising to their users and by keeping people attached to their platforms, these companies have a strong financial incentive to design their products to maximize the time users, including children, spend on their social media. The collection and exploitation of children's personal information is, in large part, what enables businesses to harness the algorithmic delivery of content designed to keep children and young people on platforms and drive up company profits in the process.

While the proposed language changes to the CCPA are simple and straightforward, the policy changes are significant. Primarily, removing the "actual knowledge" standard in the bill has the potential to dramatically change the way businesses behave when it comes to collecting, sharing, and selling the data of California's young people. Nothing in the proposed bill makes any change to the way the personal information of adults is handled. Depending on whether one finds the arguments of the author and sponsor or the opposition more compelling, the move away from requiring that businesses have actual knowledge of a consumer's age either increases privacy protections or reduces them.

On one hand, the author and sponsor argue that the actual knowledge standard "allows businesses to skirt the CCPA's specific prohibition on selling young users' data or using it for certain behavioral advertising by arguing that they did not have actual knowledge that the user was under the threshold age, which is currently age 16. This gives businesses an incentive to ignore signs that children are using their sites, and puts businesses that try to identify and protect young users at a competitive disadvantage."

On the other hand, opponents, including several privacy organizations, argue that removing that standard effectively weakens all consumers' privacy protections by requiring businesses to collect more personal information in order to verify the consumer's age. On this point, the Electronic Frontier Foundation (EFF) argues:

Changing this standard in the CCPA would spur companies to collect more data on everyone because it asks them to consider more than just what users have reported about their own age. Companies are likely to collect this personal information out of fear of being held strictly liable for violating the law. In the past, we have seen companies overcensor content or prevent broad public access to information to comply with standards that are less stringent than "actual knowledge." This is because online services have no practical way to, at scale, verify their users are adults—short of an age-gate that asks everyone for their information for the purpose of identifying children.

This argument of censorship or restricting access to information shows up throughout the opposition letters. In fact, EFF as well as a coalition of opponents that includes the California Chamber of Commerce, Chamber of Progress, and Technet suggest that requiring businesses to obtain consent for the collection, use, and sharing of children's data violates the First Amendment rights of children to both receive information and express themselves. Their letters, respectively, cite cases that invalidated prohibitions on selling minors video games with specific content. (Brown v. Ent. Merchants Ass'n (2011) 564 U.S. 786, 794 [violent video games]; Entertainment Software Ass'n v. Blagojevich (7th Cir. 2006) 469 F.3d 641, 646-47 [sexually explicit video games].) While these cases do not appear to directly implicate this bill—which is neither content-specific nor a prohibition on receiving information—such concerns arguably counsel in favor of continuing to work with stakeholders to ensure the bill is drawn as narrowly as possible without undermining its purpose.   

The coalition further argues that: 

By requiring businesses to seek the consent of a minor's parent or guardian if the minor is under the age of 13, to collect or use any of the minor's PI, this bill will prove problematic if not dangerous to some children who are seeking out information or services that their parent would not approve of. Imagine a 12-year-old wanting to browse books or find resources online to help them grapple with questions around their identity or to obtain necessary mental health services in a household where doing so would put them at risk. The business is placed in the position of having to either obtain parental consent or deny them the important resources that they are seeking out.

Nothing in this bill appears to require companies to either censor access to information on the internet or collect more personal information to verify age for the following reasons:

1. In the context of the CCPA, particularly as it relates to Section three of the bill where the term "use" currently appears in subdivision a) of that section, the paragraph clearly states that "use" does not include that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services, as defined, making it clear that the use of the term is not intended to restrict access to websites in any way.^[1] Furthermore, these restrictions are already in place for consumers who have requested that their sensitive data be limited to only those necessary uses. Presumably, consumers making that request are not restricted from using the internet or expressing themselves. What it does mean is that their sensitive information cannot be used by the business for targeted advertising or any other activity that is not strictly necessary.
2. When it comes to determining the age of a consumer, the large companies bound by the CCPA likely already have constructive knowledge of the age of their regular consumers based on the products being used. For example, if a consumer is accessing a tutoring application targeted at middle school students the owner of that application should know that the majority of their consumers are under 18 and should refrain from collecting, sharing, or selling the consumers' personal information. Similarly, while games designed for children may also have adult consumers, given the product and its targeted age group, a business should be able to reasonably determine that the majority of their consumers are under 18 and ask for consent prior to collecting any information.
3. Finally, out of an abundance of caution, businesses could choose to seek the prior authorization of all consumers prior to collecting, selling, or sharing their data. To the extent the personal information is used to target advertising or steer consumers to specific content or products, businesses could let consumers decide what is of interest to them and seek it out as they do when going into physical stores and entertainment venues.

Prior to the advent of the internet and social media, businesses determined who their targeted audiences were and then developed advertising strategies that involved placing ads in specific magazines and newspapers that were read by their targeted audience or running commercials during television shows that their target audience watched. For example, if an advertiser wanted to sell toys, they would generally run commercials during shows traditionally watched by children. It was not necessary for Lego and Mattel's success to know that Suzy Smith loved Legos and Skipper Barbie Dolls, along with Suzy's exact habits and interests, in order to specifically target advertising for those items directly at Suzy and her parents.

Given these considerations, one could reasonably argue that this bill, which restricts the collection, selling, and sharing of children's personal information is consistent with and furthers the purpose and intent of the CPRA, which is to protect consumers' rights, including the constitutional right to privacy.

According to the Author

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

While existing federal and state privacy laws offer important protections that guard children's privacy, California's groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.

Arguments in Support

Attorney General Bonta argues in support of the bill:

Because operators of social media platforms primarily earn their revenue through digital advertising to their users and by keeping people attached to their platforms, these companies have a strong financial incentive to design their products to maximize the time users—including children—spend on their social media. The collection and exploitation of children's personal information is in large part what enables businesses to harness the algorithmic delivery of content designed to lead to social media addiction in children, and drive up company profits in the process. The proposed legislation seeks to protect children from these types of business practices.

Arguments in Opposition

See previous section.

FISCAL COMMENTS

One-time costs (General Fund) to the Privacy Agency to promulgate regulations, likely in the hundreds of thousands of dollars. The agency estimates costs of $286,000 to hire an attorney for 12 months to complete the rulemaking as required by the bill. The agency anticipates any resulting enforcement workload will be absorbable in the near term, but it may require additional funding for enforcement in the future.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 8-0-3

YES: Bauer-Kahan, Bryan, Irwin, Lowenthal, Ortega, Ward, Wicks, Wilson

ABS, ABST OR NV: Joe Patterson, Dixon, Hoover

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Bryan, Calderon, Wendy Carrillo, Mike Fong, Grayson, Haney, Hart, Pellerin, Villapudua

ABS, ABST OR NV: Sanchez, Dixon, Jim Patterson, Ta

UPDATED

VERSION: April 4, 2024

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0003244

1. Civil Code Section 1798.121(a) ↑

Date of Hearing: May 1, 2024

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 1949

Author:(Wicks) – As Amended Ver:April 4, 2024

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill limits a business’s ability to collect and disclose a child’s personal information under the California Consumer Privacy Act (CCPA) and requires the California Privacy Protection Agency (Privacy Agency) to adopt regulations related to user age verification and opt-out preference signals.

Specifically, this bill:

1. Prohibits a business subject to the CCPA from collecting, using, or disclosing the personal information of a user under 18 years of age unless the user (or in the case of a user younger than 13 years old, the user’s parent or guardian) affirmatively authorizes its collection.
2. Removes the “actual knowledge” standard in the CCPA and instead prohibits a business from selling or sharing the personal information of users less than 18 years of age, unless the business receives prior authorization from the user or their parent or guardian.
3. Requires the Privacy Agency to adopt regulations that:
4. Establish technical specification for an opt-out preference signal that allows the consumer, or the consumer’s parents or guardian, to specify that the consumer is under 18 years of age.
5. Establish an age verification system capable of determining when a business must treat a consumer as being under 13 years old or under 18 years old.

FISCAL EFFECT:

One-time costs (General Fund) to the Privacy Agency to promulgate regulations, likely in the hundreds of thousands of dollars. The agency estimates costs of $286,000 to hire an attorney for 12 months to complete the rulemaking as required by the bill. The agency anticipates any resulting enforcement workload will be absorbable in the near term, but it may require additional funding for enforcement in the future.

COMMENTS:

1. Purpose. According to the author:

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures…While existing federal and state privacy laws offer important protections that guard children’s privacy, California’s groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children.

1. Background. Internet users, including children, are part of a vast economic system for collecting, buying, and selling personal data. Any time a person uses the internet, they leave behind a trail of personal information that is collected, aggregated, and monetized by internet browsers, websites, and social media platforms. Currently, the CCPA generally prohibits a business from collecting and selling the personal information of a user who is under the age of 16 if the business has actual knowledge that the consumer is less than 16 years old. This prohibition applies unless a user over the age of 13 or the parent of a user under the age of 13 opts into the sale of the user’s data.

This bill makes two significant changes to the CCPA. First, it raises the age threshold, prohibiting a business from collecting and selling personal information of a user under the age of 18. Second, it eliminates the “actual knowledge” standard. Eliminating this standard places an additional responsibility on a business to determine whether a user is a child or an adult so the business can treat the user’s personal information appropriately under the CCPA. If a business does not adhere to the CCPA’s prohibition on selling the data of a child user, under this bill, the business may be held liable even if they did not have actual knowledge of the user’s age. Proponents of this measure contend that many businesses – in particular, social media companies – have so much sophisticated, detailed data about their users that they are generally already capable of determining the age of an individual user, and should be responsible for using that information to comply with the CCPA’s age-related restrictions.

In addition to making these substantive changes, this bill requires the Privacy Agency to promulgate regulations that establish an age verification mechanism that is capable of determining whether a user is below age 13 or 18 for the purposes of compliance with CCPA’s age-related protections. The regulations must also establish technical specifications for an opt-out signal that automatically communicates a child user’s age to businesses online.

1. Support and Opposition. In support of this measure, sponsor Attorney General Rob Bonta writes:

Because operators of social media platforms primarily earn their revenue through digital advertising to their users and by keeping people attached to their platforms, these companies have a strong financial incentive to design their products to maximize the time users—including children—spend on their social media. The collection and exploitation of children’s personal information is in large part what enables businesses to harness the algorithmic delivery of content designed to lead to social media addiction in children, and drive up company profits in the process. The proposed legislation seeks to protect children from these types of business practices.

In opposition, a coalition of business groups including CalChamber, Technet, and Chamber of Progress writes:

Our member companies take seriously the privacy of all their consumers, but especially those relating to children. Unfortunately, by requiring that a business obtain affirmative consent prior to collecting, using, or disclosing the personal information (PI) of anyone under the age of 18, even in the absence of having any actual knowledge of the consumer’s age, AB 1949 not only raises significant workability issues, but also has the effect of forcing companies to further impede consumers’ right of privacy to ensure compliance. Moreover, by creating such a rigid structure, the bill disrupts the careful and deliberate balance struck by the Legislature in passing the California Consumer Privacy Act (CCPA) in 2018 and affirmed by voters in approving Proposition 24 to expand the CCPA in 2020.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 2, 2024

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 1949 (

Author:Wicks) – As Introduced Ver:January 29, 2024

AS PROPOSED TO BE AMENDED

SUBJECT: California Consumer Privacy Act of 2020: collection of personal information of a consumer less than 18 years of age

SYNOPSIS

The California Consumer Privacy Act (CCPA) gives consumers certain rights regarding their personal information, such as: (1) the right to know what personal information is collected and sold about them; (2) the right to request the categories and specific pieces of personal information that a business collects about them; and (3) the right to opt-out of the sale of their personal information, or opt-in, in the case of minors under 16 years of age.

Under current law, large businesses covered by the CCPA are prohibited from selling or sharing a child’s personal information if the business has actual knowledge of the child’s age. Attorney General, Rob Bonta, the sponsor of this bill argues that the actual knowledge standard “allows businesses to skirt the CCPA’s specific prohibition on selling young users’ data or using it for certain behavioral advertising by arguing that they did not have actual knowledge that the user was under the threshold age, which is currently age 16. This gives businesses an incentive to ignore signs that children are using their sites, and puts businesses that try to identify and protect young users at a competitive disadvantage.”

Opponents of the bill, including the California Chamber of Commerce, Technet, Chamber of Progress, and the Electronic Frontier Foundation assert that removing the actual knowledge standard actually puts consumers’ privacy at greater risk because businesses will now be required to collect more personal information to verify their consumers’ ages. However, as discussed in detail in this analysis, nothing in the bill requires the collection of more information in order to conduct age verification in order to allow people to freely access websites and internet applications.

The focus of this bill is to eliminate potential loopholes in the CCPA by prohibiting the collection, sharing and selling of children’s personal information unless the child, or their parents if under 13, consent. There are many ways that businesses could comply with the requirements of this bill without resorting to gathering more personal information from consumers. For example, businesses could certainly opt for a privacy protective approach by erring on the side of asking all consumers whether or not they want their personal information shared.

This bill is sponsored by California’s Attorney General, Rob Bonta, and has a number of supporters, including Common Sense Media and Consumer Watchdog. This bill also has a number of opponents consisting of members of the business community and various privacy advocacy groups.

SUMMARY: Amends the CCPA to prohibit a business from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer’s parent or guardian if under 13, affirmatively authorizes the collection. Specifically, this bill:

1. Prohibits a business subject to the CCPA from collecting, using, or disclosing the personal information of a consumer under 18 years of age unless the consumer, or in the case of a consumer less than 13 years old, the consumer’s parent or guardian, affirmatively authorizes its collection.
2. Removes the “actual knowledge” standard in the CCPA and instead prohibits a business from selling or sharing the personal information of consumers less than 18 years of age, unless the business receives prior authorization from the individual or their parent or guardian.
3. Requires that on or before July 1, 2025 the California Privacy Protection Agency (Privacy Agency) solicit broad public participation in the adoptions of regulations that:
   1. Establish technical specification for an opt-out preference signal that allows the consumer, or the consumer’s parents or guardian, to specify that the consumer is under 18 years of age.
   2. Establish an age verification system capable of determining when a business must treat a consumer as being less than 13 or under 18 years old.

EXISTING LAW:

1. Provides, pursuant to the California Constitution, that all people are by nature free and independent and have inalienable rights. Among these the fundamental right to privacy. (Cal. Const. art. I, § 1.)
2. States that the “right to privacy is a personal and fundamental right protected by Section 1 of Article I of the Constitution of California and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.” Further states these findings of the Legislature:
   1. The right to privacy is being threatened by the indiscriminate collection, maintenance, and dissemination of personal information and the lack of effective laws and legal remedies.
   2. The increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.
   3. In order to protect the privacy of individuals, it is necessary that the maintenance and dissemination of personal information be subject to strict limits. (Civ. Code § 1798.1.)
3. Establishes the California Consumer Privacy Act. (Civ. Code §§ 1798.100-1798.199.100.)
4. Limits a business’ collection, use, retention, and sharing of a consumer’s personal information to that which is reasonably necessary and proportionate to achieve the purposes for which the personal information was collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes. (Civ. Code § 1798.100(c).)
5. Prohibits a business from selling or sharing the personal information of a child that is 16 years of age or younger, if the business has actual knowledge of the child’s age, unless the child, or the child’s parent or guardian in the case of children less than 13 years old has affirmatively authorized the sharing of selling of the personal information. (Civ. Code § 1798.120(c).)
6. Provides that consumers have the right, at any time, to direct a business that collects sensitive personal information about the consumer to restrict the use of that information to only that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services. (Civ. Code § 1798.121(a).)
7. Establishes the Privacy Agency, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA. The Privacy Agency is governed by a five-member board, with the chairperson and one member appointed by the Governor, and the three remaining members are appointed by the Attorney General, the Senate Rules Committee, and the Speaker of the Assembly. (Civ. Code § 1798.199.10.)
8. Requires the Privacy Agency adopt regulations to further the purposes of this title, among them:
   1. Regulations to define the requirements and technical specifications for an opt-out preference signal sent by a platform, technology, or mechanism, to indicate a consumer’s intent to opt out of the sale or sharing of personal information and to limit the use disclosure of sensitive personal information.
   2. Regulations establishing technical specifications for an opt-out preference signal that allows the consumer or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age or at least 13 years of age but less than 16 years of age. (Civ. Code § 1798.185(a)(19).)
9. Defines the following terms under the CCPA:
   1. “Business” means a for-profit entity that collects consumers’ personal information, does business in California, and meets one or more of the following criteria:
      1. It had gross annual revenue of over $25 million in the previous calendar year.
      2. It buys, receives, or sells the personal information of 100,000 or more California residents, households, or devices annually.
      3. It derives 50% or more of its annual revenue from selling California residents’ personal information. (Civ. Code § 1798.140(d).)
   2. “Collects” and “collection” mean buying, renting, gathering, obtaining, receiving, or accessing any personal information pertaining to a consumer by any means. The term includes receiving information from the consumer, either actively or passively, or by observing the consumer’s behavior. (Civ. Code § 1798.140(f).)
   3. “Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information includes such information as:
      1. Name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver’s license number, passport number, or other identifier.
      2. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
      3. Biometric information.
      4. Internet activity information, including browsing history and search history.
      5. Geolocation data.
      6. Audio, electronic, visual, thermal, olfactory, or similar information.
      7. Professional or employment-related information. (Civ. Code § 1798.140(v).)
   4. “Sell” means, with certain exceptions, selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration. (Civ. Code § 1798.140(ad).)
   5. “Sensitive personal information” means personal information that reveals a person’s:
      1. Social security, driver’s license, state identification card, or passport number.
      2. Account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials.
      3. Precise geolocation.
      4. Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership.
      5. Email, mail and text messages.
      6. Genetic data.
      7. Information collected and analyzed relating to health.
      8. Information concerning sex life or sexual orientation. (Civ. Code § 1798.140(ae).)
   6. “Share,” “Shared,” or “Sharing” to mean sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a person’s personal information by a business to a third party for cross-context behavioral advertising. (Civ. Code § 1798.140(ah).)
   7. “Third party” means a person who is not any of the following:
      1. The business with whom the consumer intentionally interacts and that collects personal information from the consumer as part of the consumer’s current interaction with the business under the CCPA.
      2. A service provider to the business.
      3. A contractor. (Civ. Code § 1798.140(ai).)

FISCAL EFFECT: As currently in print, this bill is keyed fiscal.

COMMENTS:

1) Purpose of this bill. In California, the CCPA secures increased privacy rights for consumers, including the right to know what personal information businesses collect and sell and the right to stop those sales to third parties. With respect to young users, the CCPA prohibits businesses from selling the personal information of a child that they know to be under the age of 16 unless they get affirmative authorization (“opt-in”) for the sale of the child’s personal information.

The author argues that the current CCPA protections fail to protect 17-year-old users, and do not adequately limit businesses from collecting and exploiting the data of children so long as they do not sell it. These gaps in the law have, among other things, allowed companies like Google and Meta to collect, exploit, and monetize young users’ data on a massive scale.

In addition, the “actual knowledge” standard in existing law could allow businesses to skirt the CCPA’s specific prohibition on selling young users’ data or using it for certain behavioral advertising by arguing that they did not have actual knowledge that the user was under the threshold age, which is currently age 16. This loophole may incentivize some businesses to ignore signs that children are using their sites and puts businesses that try to identify and protect young users at a competitive disadvantage.

Because social media platform operators primarily earn revenue through digital advertising to their users and by keeping people attached to their platforms, these companies have a strong financial incentive to design their products to maximize the time users, including children, spend on their social media. The collection and exploitation of children’s personal information is, in large part, what enables businesses to harness the algorithmic delivery of content designed to keep children and young people on platforms and drive up company profits in the process.

The purpose of this bill is to tighten the restrictions on the collection, sharing, and sale of children’s data in order to stop businesses from placing profits over protecting the privacy rights of young people.

2) Author’s statement. According to the author:

According to research from UNICEF, approximately one in three internet users is a child who will generate tens of thousands of data points by the time the individual turns 18. This data, if used responsibly, can provide important information. However, without appropriate safeguards, it can also have a chilling effect on children at crucial development stages and potentially negatively impact their futures.

In a 2018 report, the London School of Economics noted that privacy is vital for child development. The report suggested that key privacy-related media literacy skills are closely associated with a number of child developmental areas, including autonomy, identity, responsibility, trust, pro-social behavior, resilience, and critical thinking. While online platforms can provide opportunities for such development, they also introduce and amplify risks that children may not have the capacity to navigate.

While existing federal and state privacy laws offer important protections that guard children’s privacy, California’s groundbreaking privacy protections – the CCPA and the CPRA - do not expressly include children. AB 1949 seeks to hold businesses accountable for unauthorized collection of children's data, in addition to updating safeguards and enforcements within the CCPA and the CPRA.

3) How this bill would work. This bill makes two key changes to the CCPA as it pertains to the collection, sharing, and sale of the personal information of children and young people under the age of 18:

1. It removes the “actual knowledge” standard in the law, leaving a strict prohibition against collecting, sharing, or selling the personal information of children under the age of 17 unless the child, or the child’s parent or guardian if the child is under 13, provides prior authorization for the business to do so.

2. It increases the current prohibition against selling the personal information of children from 16 years old to include all youth under 18 years old, unless the business receives explicit permission to do so.

4) The California Consumer Privacy Act and the California Privacy Rights Act (CPRA). In 2018, the Legislature enacted the CCPA (AB 375 (Chau, Chap. 55, Stats. 2018)), which gives consumers certain rights regarding their personal information, such as the right to: (1) know what personal information about them is collected and sold; (2) request the categories and specific pieces of personal information the business collects about them; and (3) opt out of the sale of their personal information, or opt in, in the case of minors under 16 years of age.

Subsequently, in 2020, California voters passed Proposition 24, the California Privacy Rights Act (CPRA), which established additional privacy rights for Californians. With the passage of the CCPA and the CPRA, California now has the most comprehensive laws in the country when it comes to protecting consumers’ rights to privacy.

In addition, Proposition 24 created the California Privacy Protection Agency (Privacy Agency) in California, vested with full administrative power, authority, and jurisdiction to implement and enforce the CCPA and the CPRA. The Agency’s responsibilities include updating existing regulations, and adopting new regulations.

To protect Californians from any future legislative efforts to weaken statutory protections in the CPRA, Proposition 24 provided that the CPRA’s contents may be amended by a majority vote of the Legislature only if the amendments are consistent with and further the purpose and intent of the CPRA, which is to further protect consumers’ rights, including the constitutional right of privacy.^[1]

5) Proposed committee amendments. The proposed amendments are intended to be technical and clarifying in nature. Specifically:

Amendment #1 clarifies the term “use” in section three of the bill –

1798.121(e) Notwithstanding any other provision of this section, a business shall not use or disclose the personal information of a consumer less than 18 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 18 years of age, or the consumer’s parent or guardian, in the case of a consumer less than 13 years of age, has affirmatively authorized the use or disclosure of the consumer’s personal information. This subdivision does not prohibit short-term, transient use of personal information that is necessary and proportional to the purpose for which it is used, and is not used, disclosed, or retained for any other purpose, including to build a profile regarding the consumer. 

Amendment #2 amends section four in the bill to reflect the change to age 18 in keeping with the purpose of the bill –

1798.185(a)(19)(B) Issuing regulations to establish technical specifications for an opt-out preference signal that allows the consumer, or the consumer’s parent or guardian, to specify that the consumer is less than 13 years of age, or at least 13 years of age and less than 16 18 years of age.

6) Analysis. The primary questions before this Committee are whether the proposed changes further goals of the CPRA by increasing protections related to children’s private information or reduces privacy protections for all consumers. If the Committee determines that it may impact consumers’ privacy, the question then becomes does the need to protect children on the internet outweigh the potential privacy risks?

While the proposed language changes to the CCPA are simple and straightforward, the policy changes are significant. Primarily, removing the “actual knowledge” standard in the bill has the potential to dramatically change the way businesses behave when it comes to collecting, sharing, and selling the data of California’s young people. Nothing in the proposed bill makes any change to the way the personal information of adults is handled. Depending on whether one finds the arguments of the author and sponsor or the opposition more compelling, the move away from requiring that businesses have actual knowledge of a consumer’s age either increases privacy protections or reduces them.

On one hand, the author and sponsor argue that the actual knowledge standard “allows businesses to skirt the CCPA’s specific prohibition on selling young users’ data or using it for certain behavioral advertising by arguing that they did not have actual knowledge that the user was under the threshold age, which is currently age 16. This gives businesses an incentive to ignore signs that children are using their sites, and puts businesses that try to identify and protect young users at a competitive disadvantage.”

On the other hand, opponents, including several privacy organizations, argue that removing that standard effectively weakens all consumers’ privacy protections by requiring businesses to collect more personal information in order to verify the consumer’s age. On this point, the Electronic Frontier Foundation (EFF) argues:

Changing this standard in the CCPA would spur companies to collect more data on everyone because it asks them to consider more than just what users have reported about their own age. Companies are likely to collect this personal information out of fear of being held strictly liable for violating the law. In the past, we have seen companies overcensor content or prevent broad public access to information to comply with standards that are less stringent than “actual knowledge.” This is because online services have no practical way to, at scale, verify their users are adults—short of an age-gate that asks everyone for their information for the purpose of identifying children.

This argument of censorship or restricting access to information shows up throughout the opposition letters. In fact, EFF as well as a coalition of opponents that includes the California Chamber of Commerce, Chamber of Progress, and Technet suggest that requiring businesses to obtain consent for the collection, use, and sharing of children’s data violates the First Amendment rights of children to both receive information and express themselves. Their letters, respectively, cite cases that invalidated prohibitions on selling minors video games with specific content. (Brown v. Ent. Merchants Ass’n (2011) 564 U.S. 786, 794 [violent video games]; Entertainment Software Ass’n v. Blagojevich (7th Cir. 2006) 469 F.3d 641, 646-47 [sexually explicit video games].) While these cases do not appear to directly implicate this bill—which is neither content-specific nor a prohibition on receiving information—such concerns arguably counsel in favor of continuing to work with stakeholders to ensure the bill is drawn as narrowly as possible without undermining its purpose.   

The coalition further argues that: 

By requiring businesses to seek the consent of a minor’s parent or guardian if the minor is under the age of 13, to collect or use any of the minor’s PI, this bill will prove problematic if not dangerous to some children who are seeking out information or services that their parent would not approve of. Imagine a 12-year-old wanting to browse books or find resources online to help them grapple with questions around their identity or to obtain necessary mental health services in a household where doing so would put them at risk. The business is placed in the position of having to either obtain parental consent or deny them the important resources that they are seeking out.

Nothing in this bill appears to require companies to either censor access to information on the internet or collect more personal information to verify age for the following reasons:

1. In the context of the CCPA, particularly as it relates to section 3 of the bill where the term “use” currently appears in subdivision (a) of that section, the paragraph clearly states that “use” does not include that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services, as defined, making it clear that the use of the term is not intended to restrict access to websites in any way.^[2] Furthermore, these restrictions are already in place for consumers who have requested that their sensitive data be limited to only those necessary uses. Presumably, consumers making that request are not restricted from using the internet or expressing themselves. What it does mean is that their sensitive information cannot be used by the business for targeted advertising or any other activity that is not strictly necessary. Out of an abundance of caution, however, the Committee amendment discussed previously clarifies what is meant by the term “use.”
2. When it comes to determining the age of a consumer, the large companies bound by the CCPA likely already have constructive knowledge of the age of their regular consumers based on the products being used. For example, if a consumer is accessing a tutoring application targeted at middle school students the owner of that application should know that the majority of their consumers are under 18 and should refrain from collecting, sharing, or selling the consumers’ personal information. Similarly, while games designed for children may also have adult consumers, given the product and its targeted age group, a business should be able to reasonably determine that the majority of their consumers are under 18 and ask for consent prior to collecting any information.
3. Finally, out of an abundance of caution, businesses could choose to seek the prior authorization of all consumers prior to collecting, selling, or sharing their data. To the extent the personal information is used to target advertising or steer consumers to specific content or products, businesses could let consumers decide what is of interest to them and seek it out as they do when going into physical stores and entertainment venues.

Prior to the advent of the internet and social media, businesses determined who their targeted audiences were and then developed advertising strategies that involved placing ads in specific magazines and newspapers that were read by their targeted audience or running commercials during television shows that their target audience watched. For example, if an advertiser wanted to sell toys, they would generally run commercials during shows traditionally watched by children. It was not necessary for Lego and Mattel’s success to know that Suzy Smith loved Legos and Skipper Barbie Dolls, along with Suzy’s exact habits and interests, in order to specifically target advertising for those items directly at Suzy and her parents.

Given these considerations, one could reasonably argue that this bill, which restricts the collection, selling, and sharing of children’s personal information is consistent with and furthers the purpose and intent of the CPRA, which is to protect consumers’ rights, including the constitutional right to privacy.

Opponents of the bill make additional arguments, some of which are included in a later section. However, the gist of the arguments relate to eroding privacy protections and requiring the collection of additional personal information in order to verify the ages of their consumers.

The intent of this bill is to prevent businesses from profiting by collecting detailed personal information of children in order to manipulate those children and drive them toward particular content or products. Social media companies have known for some time that social media use can be harmful to young users, and despite that knowledge, have continued to use algorithms and other design features to capture and hold their attention. In the fall of 2021, much of the country was enthralled by Frances Haugen’s testimony regarding Facebook’s internal research regarding the impact of social media on users, particularly young users. (Note: Facebook’s parent company renamed itself “Meta” shortly after Haugen’s testimony, an apparently unrelated event.) Haugen’s testimony claimed that social media companies are part of the reason for the child and teen mental health crisis—and that Facebook was aware of the correlation. Haugen, a former Facebook employee, testified, “Facebook chooses to mislead and misdirect. Facebook has not earned our blind faith.” According to a Facebook study leaked by Haugen, more than 13% of teen girls in the U.K. reported their suicidal thoughts became more frequent after beginning to use Instagram; another leaked study found 17% of teen girls reported their eating disorders worsened after using the platform.^[3]

Given some businesses’ seeming disinterest in self-regulating to protect children online, deciding to take a stronger approach in order to compel them to comply with California’s privacy laws, by removing the actual knowledge standard, appears to be a reasonable next step. In addition, on a larger scale, consumers and policymakers should not necessarily accept as fact that the complete erosion of privacy, particularly children’s privacy, is necessary in order for businesses and the internet to exist. This bill likely would further the protection of young Californians’ personal information and is worthy of serious consideration.

7) Related legislation. Over the last 5 years numerous bills have attempted to modify the CCPA and many have been successful in furthering its goals. In this hearing, alone, three bills, including this one, propose modifications to the CCPA. Specifically:

AB 1824 (Valencia) requires, under the CCPA, that businesses that are acquiring the personal data of consumers through the acquisition of another business, honor the previous decisions of consumers who have not given permission for the business to sell or share their personal information.

AB 3048 (Lowenthal) proposes prohibiting a business from developing or maintaining an internet browser through which a consumer interacts with a business that does not include a setting that enables the consumer to send an opt-out preference signal to that business.

ARGUMENTS IN SUPPORT:

Attorney General Bonta argues in support of the bill:

Because operators of social media platforms primarily earn their revenue through digital advertising to their users and by keeping people attached to their platforms, these companies have a strong financial incentive to design their products to maximize the time users—including children—spend on their social media. The collection and exploitation of children’s personal information is in large part what enables businesses to harness the algorithmic delivery of content designed to lead to social media addiction in children, and drive up company profits in the process. The proposed legislation seeks to protect children from these types of business practices.

Also in support, the Consumer Attorneys of California note:

In October 2023, Attorney General Bonta and a bipartisan coalition of 33 attorneys general filed a federal complaint against Meta, alleging that the company (which owns Facebook and Instagram) is violating various federal and state privacy and consumer protection laws. The complaint revealed that Meta knows that its social media platforms are used by millions of children under 13, including, at one point, around 30% of all 10 to 12-year-olds, and unlawfully collects their personal information.

The CCPA currently does not provide protections for 17 year old users, and the CCPA doesn’t limit the collection of data for children if the data is not sold. Additionally, the actual knowledge standards allows companies to skirt the law by arguing they did not have actual knowledge the user was under 16. “Actual knowledge” incentivizes a blind eye instead of trying to identify and protect young users.

AB 1949 seeks to combat these loopholes by (1) prohibiting the collection, use or disclosure of personal information for Californians under 18 without affirmative consent (consent by a parent if under 13) [and] (2) establishes that existing protections apply whether or not the business had actual knowledge that the person is under age 18. . . .

ARGUMENTS IN OPPOSITION:

Taking an “oppose unless amended” position, Oakland Privacy writes:

One of the three primary things proposed in AB 1949 is to change the age bracket for enhanced standards to include 16 and 17 year olds. It is important to remember that the standards in the CA Privacy Rights Act apply to the entire Internet, not just social media. This includes news sites, educational websites, shopping websites, and college application materials. The typical older adolescent uses online resources for many things including school assignments, and also may assist family members with online tasks (this is especially prevalent in newcomer families). While an affirmative opt-in is never a bad thing, we are not sure that treating a young adult applying for college as if they are a fourteen year old trying to get on Instagram as exactly the same problem is quite right. An affirmative opt-in, when paired with the other provisions in the bill regarding actual knowledge of a minor’s age, would likely create significant burdens on online access for young people just a few months shy of voting or being able to join the military.

[. . .]

AB 1949 adds a date of July 2025 for the California Privacy Protection Agency to issue regulations regarding technical specifications for an opt-out/opt-in preference signal, along with age verification procedures. We agree with the author that a global preference signal is the desired long-term solution for operationalizing the CPRA, including the restrictions on selling and sharing children’s data without consent.

[I]f AB 1949 were to be adopted as written, it would be demanding these regulations and technical specifications be issued less than 7 months after the bill takes effect, which would be a demanding schedule for the CA Privacy Agency to meet. In addition, this timing would encourage businesses to implement age verification procedures for the period from January to July of 2025 (at least) that would then be subject to change after the CPPA issues its regulations.

To be clear, we are privacy advocates and not advocates for business interests, so the problems that the AB 1949 timeline would cause to businesses is not the primary focus of our advocacy. But we do believe that public policy should be enforceable and should be structured so that regulated entities can comply with reasonable, not extraordinary, efforts. The proposed timeline in AB 1949 doesn’t make sense, from our point of view.

REGISTERED SUPPORT / OPPOSITION:

Support

Attorney General, Rob Bonta (sponsor)
Children's Advocacy Institute
Childrens Advocacy Institute
Common Sense Media
Consumer Attorneys of California
Consumer Watchdog

Support If Amended

ACLU California Action

Opposition

American Property Casualty Insurance Association
California Chamber of Commerce
Chamber of Progress
Civil Justice Association of California
Computer & Communications Industry Association
Electronic Frontier Foundation
Privacy Rights Clearinghouse
Software & Information Industry Association
Technet

Oppose Unless Amended

Oakland Privacy

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Ballot Pamphlet. Primary Elec. (Nov. 3, 2020) text of Prop. 24, p. 74 ↑

2. Civil Code § 1798.121(a) ↑

3. Allyn, Here are 4 key points from the Facebook whistleblower’s testimony on Capitol Hill, National Public Radio (Oct. 5, 2021), available at https://www.npr.org/2021/10/05/1043377310/facebook-whistleblower-frances-haugen-congress ↑