Children's Data Privacy Rules by State

Considered Sensitive Data, therefore:

1. Consent required for all processing

2. DPA required

Note: COPPA also applies nationwide

In addition to being considered Sensitive Data:

1. General restrictions:

a. Only allowed if the processing is necessary to provide an online product, service or feature

b. No secondary uses (uses for purposes other than those disclosed at time of collection)

c. Cannot retain longer than necessary

2. No targeted advertising, selling, or profiling

3. Geolocation collection only allowed if:

a. Necessary to provide an online product, service or feature, and

b. Business provides a signal to alert consumer that it is tracking their location

4. DPA required for any online service, product, or feature that is directed to children

1. Consent required for:

a. Targeted advertising, selling, profiling

b. Secondary uses of personal data

c. Keeping data for longer than is reasonably necessary to provide the online service

d. Using any system design feature meant to increase, sustain, or extend a minor’s use of the online service

2. Geolocation collection only allowed if:

a. Reasonably necessary to provide an online service

b. Business provides a signal to alert consumer that it is tracking their location

c. Business retain geolocation data only as long as necessary to provide an online service

3. Businesses that offer direct messaging must offer reasonable safeguards to limit unsolicited messages to minors from adults

4. DPA required if online service presents a heightened risk of harm to minors

Note: a separate, but related privacy law prohibits targeted advertising, selling, and profiling of minors under 18 without consent.

Also requires DPAs. It applies when controller has actual knowledge or "knowledge fairly implied based on objective circumstances" regarding the minor's age

There is a rebuttable presumption that a business has used reasonable care to avoid a heightened risk of harm to minors if they get consent for the following:

1. Use a minor’s data for targeted advertising, selling, profiling

2. Use minors’ data for secondary purposes

3. Use minors’ data for longer than is reasonably necessary to provide the online service, product, or feature.

4. Use a system design feature to significantly increase, sustain, or extend a minor's use of the online service, product, or feature.

5. Collect minors’ precise geolocation unless:

a. It is reasonably necessary;

b. It is only retained as long as necessary to provide the service, product or feature; AND

c. The business provides a signal to the minor that it is collecting their precise geolocation