New California Privacy Law Expands Protections for Children

California Governor Gavin Newsom recently signed into law the California Age-Appropriate Design Code Act (AADCA), which significantly increases the privacy protections that businesses must extend to children online. The AADCA builds on an existing federal privacy law, the Children’s Online Privacy Protection Act (COPPA), but takes those protections to a whole new level by greatly expanding their reach.

The new law does not go into effect until July 1, 2024, but some of the compliance measures will take a lot of planning so it’s never too early to get a handle on it. Learn about when the AADCA applies and what it requires from businesses.

When Does the AADCA Apply?

The AADCA applies to “businesses that develop and provide online services, products, or features that children are likely to access.” This raises three main questions:

1. What is a business?
2. What counts as a child?
3. What does “likely to access” mean?

1. What Is a Business?

The AADCA applies to “businesses”; fortunately, we already have a familiar definition for that term because the new law explicitly refers to the California Consumer Privacy Act (CCPA) for many of its key definitions. Under the CCPA, a business is a for-profit entity that collects personal information, does business in California, and meets at least one of the following criteria:

1. Has at least $25 million in gross annual revenue
2. Buys, sells, or shares the personal information of at least 100,000 California residents annually
3. Derives 50% or more of its annual revenue from the sale or sharing of personal information

To learn more about how these criteria are calculated, read our defined in the CCPA) any personal information that is not necessary to provide an online service with which a child is actively and knowingly engaged, unless the business can demonstrate a compelling reason why it is in the best interests of the child.

Profiling

By default, businesses may not engage in the profiling of minors. Profiling is any automated processing of personal information that is used to evaluate a person, such as using past purchases to predict future shopping behavior.

However, a businesses may profile a child by default if two conditions are met:

• The business can demonstrate it has appropriate safeguards in place to protect children, and
• At least one of the following is true:some text
  • The profiling is necessary to provide the online service requested and only with respect to the aspects of the online service with which the child is actively and knowingly engaged, or
  • The business can demonstrate a compelling reason that profiling is in the best interests of children