Children’s privacy laws US

For organisations carrying out processing activities in the United States, the recent developments around children’s privacy laws will be of particular interest. These laws not only impact how the data of children in the United States may be collected, but also how it can be used.

The federal Children’s Online Privacy Protection Act (“COPPA”) is one privacy law of particular note, which establishes a strict set of guidelines businesses must follow in order to protect children’s personal data when they access online services, games, apps, or websites.

Children’s privacy has now become a top priority in the United States at both federal and state levels. Efforts to protect children online have increased significantly in the last year and with the landscape relating to children’s data ever changing, more individual states are looking to enact their own data privacy laws.

A very brief history of Children’s privacy laws in the US

Historically, California has probably been the most active in terms of enforcing its privacy laws in relation to children, and evidence of this can be found in the recent action taken against Tilting Point Media under the California Consumer Privacy Act (CCPA).

The US-based game publishers were alleged to have developed a game (SpongeBob) that did not have sufficient safeguards in place to obtain parental consent before collecting, disclosing, selling or sharing the personal data of users under the age of 13, nor was there an opt-in (positive action) for capturing consent to collect, disclose, sell or share the personal data of users aged at least 13 and under 16.

As the Software Development Kits used – a set of tools to build software for a particular platform (“SDKs”) – were also alleged to have not been configured correctly, it meant that they did not limit the collection, disclosure or use of personal data based on a user’s age.

The use of a non-neutral age screen also failed to encourage users to enter their age accurately and defaulted to older ages (meaning that users under the age of 16 would likely be directed to the adult version of the game). Upon review, it was also found that the privacy notice related to minors was also not compliant with the legal requirements.

As part of the judgement, in addition to the payment of a $500,000 fine, Tilting Point Media were required to:

• Provide a “just-in-time notice” explaining what personal data was being collected from children, the purpose for collection, if the data was to be sold or shared, and a link to the privacy policy explaining the required parental or opt-in consent;
• Use only neutral age screens that encourage children to enter their age accurately;
• Comply with laws and best practices related to advertising to minors and minimise data collection and use from children; and
• Implement and maintain a program to assess and monitor its compliance with the judgment, including annual reports.

Further to the above, they were also required to appropriately configure third-party SDKs to comply with legal requirements related to children’s data and implement and maintain an SDK governance framework to review the use and configuration of SDKs within its apps.

Website and app developers using SDKs need to do this

Therefore, if you are an app developer or website owner who uses SDKs (along with cookies, pixels or scripts) as part of your code, we would advise carrying out an in-depth review of your product to ensure that you fully understand what personal data you collect and/or share as part of your processing activities.

Once completed, not only will you be able to align your current processes with the requirements of the data privacy laws, but you will also be able to implement measures to minimise any potential privacy risks moving forward.

Additional state laws to protect children’s well being online

It is important to note that it is not only enforcement under the CCPA that is on the rise, on 8^th October 2024 New York’s Attorney General co-led a coalition suing TikTok for profiting from children’s data for misuse of children’s data in violation of the Children’s Online Privacy Protection Act (and other practices).

This follows similar complaints filed by the Attorney Generals of California, Illinois, Kentucky, Louisiana, Massachusetts, Mississippi, New Jersey, North Carolina, Oregon, South Carolina, Vermont, Washington, and the District of Columbia.

Throughout 2024, a number of states have proposed additional laws to protect the privacy and well-being of children online. These include:

• Colorado introduced SB 24-041 to amend the Colorado Privacy Act;
• Georgia introduced SB 351;
• Hawaii introduced SB2309 and SB2012 (similar to California’s AADC);
• Illinois introduced HB3880;
• Minnesota introduced HF 2257/SF 2810 (an AADC bill);
• New Mexico introduced SB 68 (an AADC bill);
• Pennsylvania introduced Bill 1879;
• South Carolina introduced H 4541 and H 4842 (a version of the AADC);
• Vermont introduced H.712;
• Virginia introduced HB 707 and HB 821, and SB 361 and SB 684; and
• West Virginia introduced HB 4718

It is evident that there is an increase in regulatory focus on protecting children’s online privacy and safety, with federal and state level lawmakers looking to update current legislation, whilst introducing fresh measures to tackle the evolving digital landscape.

The implementation and enforcement of these laws however remains an ongoing challenge.

What else is new?

The Governor of California has since signed a new bill (the Protecting Our Kids from Social Media Addiction Act – effective 1^st January 2027) which is aimed at social media sites that are “addictive” to children. This bill prohibits online platforms from knowingly providing an addictive feed to a minor without parental consent. It also gives parents certain rights which include letting parents decide whether children see messages chronologically or based on the sites’ algorithms. In addition, the bill also prohibits social media platforms from sending notifications to minors during school hours and late at night.

The above Californian law is similar to one in New York (The SAFE For Kids Act), which also requires that any person or business (or other legal entity) that operates or provides an addictive social media platform use commercially reasonable and technically feasible methods to determine that their users are not minors. This law is in addition to the New York Child Data Protection Act which enters into force on 20^th June 2025.

It’s not only California and New York that have been active in terms of children’s privacy, Connecticut have recently made amendments to sections of their Online Privacy Act (effective 1^st October 2024), along with Maryland whose own Age-Appropriate Design Code entered into force on the same day.

What steps should your organisation take?

If your organisation will be collecting personal data from children located in the United States as part of your processing activities, you can align with the laws that are currently in effect as well as prepare for those that are upcoming by:

• Obtaining parental consent if collecting personal data online from those under 13 (Children’s Online Privacy Protection Rule (“COPPA”));
• Considering any state specific requirements – children’s data could include those under the age of 18 (not just those under 13 – COPPA) depending on the relevant state where processing is taking place;
• Ensuring that all consent is opt-in, i.e. a positive action or indication (especially when using trackers for advertising purposes);
• Assessing whether your collection of personal data constitutes a ‘dark pattern’ (as being in breach of COPPA rules can result in large monetary penalties)
• Only collecting and processing personal data that you need to fulfil your purpose;
• Keeping the concepts of harm in mind prior to, and throughout your data processing projects or activities.

The above steps can help your organisation to comply with the requirements of relevant privacy laws when collecting personal data from children in the United States and also help to assess which of your proposed activities would be appropriate when engaging with children directly.

Do you need support with compliance with the Children’s Design Code?

If you need support in meeting any of the above requirements, we’re here to help. From Data Protection Impact Assessments to identifying risks to implementing age-appropriate design, we can help you every step of the way. Get in touch today.