California S.B. 568, “Privacy Rights for California Minors in the Digital World” (Cal. Bus. & Prof. Code § 22580-22581) took effect on Jan. 1, 2015. Enacted as an amendment to CalOPPA, the law contains two main provisions: 1) the right for a California minor to request the removal of content or information posted online (nicknamed the “Internet Eraser Law”), and 2) restrictions on the advertising of certain products and services to minors.
The law requires any online service (which is defined broadly to include any “Internet Web site, online service, online application, or mobile application”) to permit minors to remove or request the removal of posted content or information. The law applies to online services that are directed to minors (meaning that the service, either in whole or in part, targets minors as its intended audience) or an online service that has actual knowledge that a minor is using the service (which would include any company that collects a birth date of a user), and only applies to online services with minors who are “registered users” of the service. The online service must post notice and instructions to direct the minor how to delete the information. Additionally, the online service must provide notice if “complete and comprehensive” removal of the content is not possible.
The Privacy Rights for California Minors law also prohibits online services from advertising certain products such as alcoholic beverages, firearms and ammunition, tobacco products, tattoos, tanning beds, fireworks, aerosol paint containers, lottery tickets, dietary supplements containing ephedrine, drug paraphernalia and obscene matter if the online service is directed to minors or if the operator has actual knowledge that the online service is being used by a minor. The law also applies to targeted advertising and prohibits advertising of the enumerated products to minors “based on information specific to that minor, including” information such as “the minor’s profile, activity, address or location.” Operators of online services are also prohibited from providing minors’ personal information to a third party or allowing a third party to collect minors’ personal information for the purpose of advertising any of the specified products or services.
If an online service is directed to minors or has actual knowledge that minors are registering with the service, the company should take the following actions toward compliance:
2. Develop an internal procedure and policy to determine how the company will handle deletion requests. Will content be deleted permanently or be retained internally? Will content be deleted or anonymized? Will the company provide a deletion mechanism through the “settings” or must the user contact customer service to request content be deleted?
3. If the online service is directed to minors, notify in writing any third-party advertising partners (including advertising firms, ad networks and the like) that the online service is directed to minors. Keep a record of that notification.
4. If the online service has actual knowledge that minors are using its service, take “reasonable actions in good faith” to avoid marketing or advertising the prohibited products listed above.
5. Develop standard contractual provisions and consider addenda to existing contracts to restrict the collection and use of data from the company’s online services by third-party ad partners.
Violations of the new law will likely be enforced by the California Attorney General under the state’s unfair competition law, which provides for a penalty of $2,500 per violation.******
Orrick’s Cybersecurity and Data Privacy Group is an interdisciplinary team with members in the U.S., Europe and Asia. We craft practical solutions across a host of risk management, consumer protection, brand protection, investigatory and litigation contexts. We leverage our relationships with leading privacy and security consultants, domestic and international law enforcement, government, academia and policy groups, so that our clients benefit from multi-angle solutions.
For more information about these developments, please contact the authors of this alert or your Orrick relationship partner.