Under the CCPA, when may a business sell or share a minor's personal information, and who authorises it for under-13s and 13-to-15-year-olds?

## The rule Under the CCPA as amended by the CPRA, adults are protected by an **opt-out**: the business may sell or share until they object. For minors, Civil Code `1798.120(c)` reverses that: In paraphrase: a business shall not sell or share the personal information of a consumer it actually knows is under 16, unless the consumer (if 13 to 15) or a parent or guardian (if under 13) has affirmatively authorised the sale or sharing. `1798.120(d)` then forbids selling or sharing a minor's personal information for which the business has not received consent, until consent is given. ## Who authorises | Age | Who must affirmatively authorise | Regulation | |---|---|---| | Under 13 | A parent or guardian | 11 CCR 7070 | | 13 to 15 | The consumer themself | 11 CCR 7071 | | 16 and over | No opt-in; the adult opt-out applies | `1798.120(a)` | ## Knowledge of age - The rule turns on **actual knowledge** that the consumer is under 16. - A business that **wilfully disregards** the consumer's age is **deemed** to have actual knowledge (`1798.120(c)`). - In practice, the wilful-disregard rule reaches age signals the business already holds, such as a birth date field, a 'grade' selector in a homework app or a child profile. ## How consent must be obtained **Under 13 (11 CCR 7070):** 1. Establish, document and follow a **reasonable method** to determine that the person consenting is the child's **parent or guardian**. 2. That consent is **in addition to** any verifiable parental consent required under COPPA. 3. Methods the regulation lists include a consent form signed under penalty of perjury and returned by post, fax or scan; a payment card or online payment system that notifies the primary account holder of each transaction; a toll-free call or video conference with trained staff; an in-person meeting; or checking government-issued identification against databases, deleting the identification promptly afterwards. 4. After consent, tell the parent or guardian about the right to opt out and how to use it. **13 to 15 (11 CCR 7071):** 1. Establish, document and follow a reasonable process for the consumer to **opt in**, using the **two-step** opt-in of 7028: a clear request, then a separate confirmation. 2. Tell the consumer about their **ongoing right to opt out** at any time. 11 CCR 7072(a) requires the privacy policy to describe these processes. ## After a refusal `1798.135(c)(5)`: for consumers under 16 who do not consent, the business must refrain from selling or sharing and wait **at least 12 months** before asking again, or as the regulations allow, or until the consumer turns 16. ## A worked case: a homework-help app A homework-help app embeds an advertising SDK that passes device identifiers to ad networks for cross-context targeting, which is sharing. Its sign-up asks for grade level. - For users who select a grade typical of under-13s, it must obtain a parent's or guardian's authorisation by a documented reasonable method before any sharing; the SDK must not transmit identifiers until then. - For users aged 13 to 15, it needs the teen's own two-step opt-in. - If consent is refused, sharing stays off and the prompt stays suppressed for 12 months or until the user turns 16. 11 CCR 7072(b) adds one simplification: a business that **exclusively** targets offers to consumers under 16 and never sells or shares without the required consent need not provide the Notice of Right to Opt-out of Sale/Sharing. ## Why it is asked It tests whether a candidate knows that the CCPA's opt-out model has an opt-in exception, where the age line sits, and that 'we never asked their age' is not a defence when the business wilfully disregards what its own data shows.