Does CCPA protect my children's data?

What the Law Says

The California Consumer Privacy Act (CCPA) includes specific safeguards for minors’ personal information, recognizing that children are more vulnerable to data exploitation.

The CCPA prohibits businesses from selling the personal information of consumers under 16 years old — unless they first obtain affirmative authorization (opt-in consent). For children under 13, that consent must come from a parent or legal guardian. For teens aged 13 to 15, the minor themselves may provide opt-in consent.

If a business has actual knowledge it is selling a child’s personal information and fails to obtain proper consent, it faces civil penalties of up to $7,500 per violation. The law also allows a 30-day opportunity to cure the violation before penalties apply — but only if the Attorney General provides notice and the business actually fixes the issue.

The CCPA defines 'sell' broadly — it includes sharing personal information for monetary or other valuable consideration, such as targeted advertising or data monetization.

Statutory Text

A business shall not sell the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, or the consumer's parent or guardian for consumers under 13 years of age, has affirmatively authorized the sale of the consumer's personal information.

— Civil Code § 1798.120(c) — Sale of information of minors

Statutory Text

Any business that violates this title shall be liable for a civil penalty not to exceed two thousand five hundred dollars ($2,500) for each violation, or seven thousand five hundred dollars ($7,500) for each intentional violation.

— Civil Code § 1798.155(a) — Civil penalties

What to Do

Sources