US state comprehensive privacy laws like the California Consumer Privacy Act (CCPA) have been garnering much attention over the past year.
However, new requirements with respect to the processing of children’s data are occurring at the US state level and seemingly flying below the radar.
Participants in the ad tech ecosystem should take note. These changes could have a material impact on targeted advertising in the United States. Below are some key takeaways.
An ever-increasing age of consent
While there are a number of US laws regulating the use of children’s data, the obligation to obtain consent before collecting such data in the US had largely been limited to the Children’s Online Privacy Protection Act (COPPA) and its verifiable parental consent requirement, which applies to children under the age of 13.
In recent years, however, the CCPA and the Connecticut Data Privacy Act (CTDPA) has expanded upon COPPA’s consent rule, requiring businesses to also obtain opt-in consent from minors between 13-15 years old before selling their personal data or conducting targeted advertising.
New Jersey’s new comprehensive privacy law, S.B. 332, will push that age up to 16.
And amendments to the CTDPA, discussed below, will require prior opt-in consent for minors between the ages of 13 and 17 for sales of personal information, targeted advertising and certain types of profiling.
Age-appropriate design
Two states have enacted legislation that would require holistic privacy design changes for online services geared toward minors under 18. (Actually, it’s three if you include Florida’s S.B. 262, which only applies to companies that make over $1 billion in annual revenue.)
The California Age-Appropriate Design Code Act (“CAADCA”) would (subject to the First Amendment challenges discussed below) apply to entities that qualify as “businesses” under the CCPA and provide an online service, product or feature “likely to be accessed by children [under 18].”
Connecticut S.B. 3, which amends the CTDPA, will apply to “controllers” under the CTDPA that offer any online service, product or feature to consumers for whom the controller “has actual knowledge, or willfully disregards, are minors [under 18].”
Both laws, with some differences in how their requirements are worded and may apply, obligate companies to design their services in ways that avoid material risks to children, conduct data protection assessments and limit data processing to purposes that are reasonably necessary to provide their services.
Additionally, both laws place restrictions on profiling and the collection of precise geolocation information. They also prohibit manipulative design features that impair a child’s decision-making with respect to data privacy.
Although the CAADCA was scheduled to go into effect on July 1, 2024, the law was challenged on First Amendment grounds and was enjoined by a California federal district court, pending an appeal to the Ninth Circuit.
Connecticut S.B. 3 will become effective on October 1, 2024.
Social media restrictions
While many companies rely on social media for advertising and marketing, new state laws may complicate efforts to reach younger audiences.
Louisiana S.B. 162, effective July 1, 2024, prohibits social media companies from displaying any advertising on the account of a minor under the age of 16 that’s based on the minor’s personal information, except for age and location.
Meanwhile, beginning March 1, 2024, Utah S.B. 152 will prohibit social media platforms from displaying any advertising to accounts for users under 18.
Finally, Texas H.B. 18, effective September 1, 2024, similarly prohibits targeted advertising to minors under 18 unless the social media platform has parental approval.
Although the above laws regulate social media companies, and not advertisers, these laws could have an indirect effect on businesses that use social media for marketing and advertising. If this trend continues, social media may be an increasingly unreliable way to advertise to minors.
The bottom line
Companies in the ad tech ecosystem need to carefully evaluate whether they collect and process information relating to minors (however that term is defined under the relevant laws).
If they do, they must be mindful of the above requirements and nuances under the different state laws.
“Data-Driven Thinking” is written by members of the media community and contains fresh ideas on the digital revolution in media.
Follow Davis+Gilbert LLP and AdExchanger on LinkedIn.
For more articles featuring Richard Eisert, click here.
