New California Privacy Law for Minors Has Taken Effect as of January 1, 2015

California S.B. 568, titled "Privacy Rights for California Minors in the Digital World," (the "Privacy Law") took effect January 1, 2015.¹ The new Privacy Law includes a provision known as the "Eraser Law" that gives California minors a right to delete content that they posted to a website, social media profile, or online service while under the age of 18. The Privacy Law also includes restrictions on marketing or advertising certain enumerated products and services to minors.

Application of the Privacy Law

Application of the Privacy Law is limited to any "operator" of an Internet Web site, online service, online application, or mobile application or portion thereof (collectively, "Online and Mobile Properties") that is either "directed to minors" or is actually used by minors. The Privacy Law does not apply to third parties that operate, host, or manage, but do not own, an Online or Mobile Property, or that process information on the owner's behalf.²

The Privacy Law applies to any operator of an Online or Mobile Property ("Operator") that is created for the purpose of reaching an audience that is "predominantly" comprised of minors, and is not intended to apply to a general audience composed predominantly of adults (such general audience Online and Mobile Properties are referred to herein as "General Audience Property(ies)").³ The term "minors" as used under the Privacy Law is defined to mean natural person individuals under the age of 18 who reside in California.⁴ The Privacy Law also applies to Operators of General Audience Properties that have actual knowledge that their General Audience Properties are being used by minors.⁵ The Privacy Law does not require Operators of Online or Mobile Properties or Operators of General Audience Properties to collect age information about their users.

The California Eraser Law

The portion of the Privacy Law referred to as the Eraser Law requires Operators of Online or Mobile Properties that are directed to minors and Operators that have actual knowledge that their General Audience Properties are being used by minors, to permit minors who are registered users to (1) remove, or (2) if the Operator prefers, to request and obtain removal of content or information that the minors have posted.⁶ It also requires these Operators to issue notices to minors who are registered users of their right to remove or to request and obtain removal of content or information posted by that minor registered user.⁷ The Operator must provide clear instructions to minors who are registered users on how a minor may remove, or request and obtain removal of, such content or information and notify such minors that removal does not ensure complete or comprehensive removal of the content or information posted on the Operator's Online or Mobile Property.⁸

The Eraser Law does not require Operators to erase, or otherwise eliminate, or enable erasure or elimination of, content or information that minors have posted in the following circumstances:

• If any other provision of federal or state law requires the Operator to maintain the content or information;
• If the content or information was stored on or posted to the Operator's Online or Mobile Property by a third party other than the minor, who is a registered user, including any content or information posted by the registered user that was stored, republished or reposted by a third party. This would encompass content that a minor's friends or other third parties post about the minor as well as content that was reposted by other registered users;
• If the Operator has anonymized the content or information so that the minor cannot be individually identified;
• If the minor failed to follow instructions for submitting a request for removal; or
• If the minor received compensation or other consideration for providing the content or information.⁹

An Operator will be deemed to be in compliance with the requirements of the Eraser Law if the Operator renders the content specifically identified for removal no longer visible to users. Compliance does not require complete removal from the Operator's servers and does not cover content that remains visible after the original posting is removed because a third party copied or reposted the content.¹⁰

Restrictions on marketing or advertising certain products and services

As mentioned above, the Privacy Law also restricts Operators of Online or Mobile Properties directed to minors and Operators of General Audience Properties that have actual knowledge that a minor is using the General Audience Properties, from marketing or advertising certain enumerated products and services to minors.¹¹ A complete list of these products and services is set forth in the Privacy Law and includes, among other items: alcohol; firearms or guns; aerosol paint containers; tobacco; cigarettes or other related tobacco or tobacco prep products; BB devices; "dangerous fireworks;" tanning in ultraviolet tanning beds; dietary supplements; salvia (hallucinogenic sage) products; tattoos; and obscene matter (the "Restricted Products List").¹² The Privacy Law imposes the following restrictions:

• Operators of Online or Mobile Properties that are directed to minors are prohibited from marketing or advertising any products or services on the Restricted Products List on their Online or Mobile Properties.¹³
• Operators of a General Audience Property that have actual knowledge that a minor is using the General Audience Property are prohibited from engaging in marketing or advertising products and services on the Restricted Products List only if the Operator uses information specific to the minor that the Operator may have collected, such as name or profile, to direct the advertisements.¹⁴ These Operators are deemed to be in compliance with this prohibition if they take "reasonable actions in good faith" to avoid such marketing and advertising.¹⁵
• Both Operators of Online or Mobile Properties that are directed to minors and Operators of General Audience Properties that have actual knowledge that a minor is using such Properties are prohibited from knowingly using, disclosing, compiling, or allowing a third party to use, disclose or compile, the personal information of a minor with actual knowledge that the use, disclosure, or compilation is for the purpose of marketing or advertising products or services that are included in the Restricted Products List to that minor.¹⁶

Enforcement

The Privacy Law does not contain a private right of enforcement or any express penalty or enforcement provisions; however, like the California Online Privacy Protection Act,¹⁷ it is likely to be enforced under the California Unfair Competition Law, which provides for a civil penalty of up to $2,500 per violation.¹⁸

Practice pointers

To comply with the Eraser Law, all companies that qualify as Operators of Online or Mobile Properties that permit content or information to be posted to their Properties should establish procedures to remove content or information posted by minors under the age of 18 who are registered users of their Properties. These companies can enable minors to remove the content or information or require that minors submit requests for such removal and implement a process for accepting and fulfilling such requests. Additionally, such companies should update their privacy policies or other relevant disclosures to (i) notify and inform minors of their right to request removal, (ii) describe the relevant removal procedures, and (iii) inform minors that removal does not ensure that the posted content or information will be completely or comprehensively deleted.

To comply with the prohibitions against marketing or advertising the products and services in the Restricted Products List, companies that qualify as Operators of Online or Mobile Properties directed to minors under the age of 18 must ensure that they do not serve ads for or market any of the specified products or services. Operators of General Audience Properties that become aware that a minor under the age of 18 is using the relevant Property must take reasonable steps to ensure that they do not use data collected from the minor to market or advertise a product or service on the Restricted Product List to that minor. Operators of Online or Mobile Properties directed to minors and Operators of General Audience Properties that become aware that a minor under the age of 18 is using such Properties must take steps to ensure that they (1) do not knowingly use, disclose, compile, and (2) do not allow a third party to use, disclose or compile, the personal information of a minor with actual knowledge that the use, disclosure, or compilation is for the purpose of marketing or advertising a product or service included in the Restricted Products List to that minor.

NOTES

1 California S.B. 568 amends Division 8 of the California Business and Professions Code to add Chapter 22.1. It was signed into law on September 23, 2013. Read the full text of S.B. 568.

2 Cal. Bus. & Prof. Code § 22580(f).

3 id. 22580(e). An Online or Mobile Property shall not be deemed to be directed at minors solely because it refers or links to an Online or Mobile Property directed to minors by using information location tools, including a directory, index, reference, pointer, or hypertext link. id.

4 Cal. Bus. & Prof. Code § 22580(d).

5 Such actual knowledge may be obtained through data collected from its minor registered users, for example.

6 "Posted" is defined as content or information that can be accessed by a user in addition to the minor who posted the information, whether the user is a registered user or not, of the Online or Mobile Property where the content or information is posted. Cal. Bus. & Prof. Code § 22581(f).

7 Cal. Bus. & Prof. Code § 22581(a)(1)-(2).

8 id. § 22581(a)(3)-(4).

9 These exceptions are set out in § 22581(b)(1)-(5).

10 Cal. Bus. & Prof. Code § 22581(d).

11 id. § 22580. Under the Privacy Law, "marketing or advertising" means, in exchange for monetary compensation, to make a communication to one or more individuals, or to arrange for the dissemination to the public of a communication, about a product or service the primary purpose of which is to encourage recipients of the communication to purchase or use the product or service. Cal. Bus. & Prof. Code § 22580(k).

12 id. § 22580(i)(1)-(19).

13 id. § 22580(a). If the marketing or advertising is provided by an advertising service, an Operator of an Online or Mobile Property directed to minors will be deemed in compliance with the prohibition in § 22580(a) if the Operator notifies the advertising service, in the manner required by the advertising service, that the Operator's Online or Mobile Property is directed to minors. Cal. Bus. & Prof. Code § 22580(h)(1).

14 id. § 22580(b)(1).

15 id. § 22580(b)(2).

16 id. § 22580(c).

17 id. §§ 22575-22579.

18 Cal. Bus. & Prof. Code § 17206(a).

This content is provided for general informational purposes only, and your access or use of the content does not create an attorney-client relationship between you or your organization and Cooley LLP, Cooley (UK) LLP, or any other affiliated practice or entity (collectively referred to as “Cooley”). By accessing this content, you agree that the information provided does not constitute legal or other professional advice. This content is not a substitute for obtaining legal advice from a qualified attorney licensed in your jurisdiction and you should not act or refrain from acting based on this content. This content may be changed without notice. It is not guaranteed to be complete, correct or up to date, and it may not reflect the most current legal developments. Prior results do not guarantee a similar outcome. Do not send any confidential information to Cooley, as we do not have any duty to keep any information you provide to us confidential. This content may be considered Attorney Advertising and is subject to our legal notices.