HB 707

Abstract

Consumer Data Protection Act; protections for children. Prohibits, subject to a parental consent requirement, a data controller from processing personal data of a known child (i) for the purposes of targeted advertising, the sale of such personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer; (ii) unless such processing is reasonably necessary to provide the online service, product, or feature; (iii) for any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose; or (iv) for longer than is reasonably necessary to provide the online service, product, or feature. The bill prohibits, subject to a parental consent requirement, a data controller from collecting precise geolocation data from a known child unless (a) such precise geolocation data is reasonably necessary for the controller to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controller shall only collect such data for the time necessary to provide such online service, product, or feature and (b) the controller provides to the known child a signal indicating that such controller is collecting such precise geolocation data, which signal shall be available to such known child for the entire duration of such collection. The bill prohibits a data controller from engaging in the activities described in the bill unless the controller obtains consent from the child's parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act. This bill has a delayed effective date of January 1, 2025, and is identical to SB 361.

Consumer Data Protection Act; protections for children. Prohibits a data controller from processing personal data of a known child (i) for the purposes of targeted advertising, the sale of such personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer; (ii) for any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose unless such processing is reasonably necessary to provide an online service, product, or feature; or (iii) for any processing purpose without first obtaining consent from the child's parent or legal guardian.The bill prohibits a data controller from collecting precise geolocation data from a known child unless (a) such precise geolocation data is reasonably necessary for the controller to provide such online service, product, or feature; (b) the controller provides to the known child a signal indicating that such controller is collecting such precise geolocation data; and (c) the controller obtains consent from the child's parent or legal guardian.Additionally, the bill requires each data controller that, on or after January 1, 2025, offers any online service, product, or feature directed to consumers whom such controller has actual knowledge are children to conduct a data protection assessment for such online service, product, or feature that addresses (1) the purpose of such online service, product, or features; (2 the categories of known children's personal data that such online service, product, or feature processes; and (3) the purposes for which such controller processes known children's personal data with respect to such online service, product, or feature.