The CCPA does not require you to know or to ask how old your consumers are, but if you have actual knowledge or a strong reason to know that a consumer is under age 16, you need to obtain an opt in before selling their personal information rather than providing an opportunity to opt out of sales. Different rules apply for consumers younger than age 13 versus those aged 13, 14 and 15.
If a child is younger than age 13, an opt in to sales needs to come from their parent or guardian, and you need to verify that person’s status as the parent or guardian using a reasonable and documented method. For example, you can obtain a sworn statement that is signed and mailed or scanned, confirm using a payment card, or check and then delete a copy of a government ID. Note these rules are different than the rules for verifying an adult consumer’s identity where the CCPA encourages you to do so without requesting new or sensitive information such as a government ID.
For children aged 13-15, the child him or herself can opt in using the same double opt-in procedures that apply to adults who opt in after opting out of data sales. For opt-ins for children of any age, always inform the parent or child of their right to opt out again later, and how to do so.
While there are similarities between the CCPA and the federal children’s privacy law called the Children’s Online Privacy Protection Act, or COPPA, compliance with the federal law is not a substitute for compliance with the CCPA, and vice versa. In other words, even if you obtain parental consent under the CCPA, you must continue to comply with COPPA.