SB 361

Abstract

Consumer Data Protection Act; protections for children. Prohibits, subject to a parental consent requirement, a data controller from processing personal data of a known child (i) for the purposes of targeted advertising, the sale of such personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer; (ii) unless such processing is reasonably necessary to provide the online service, product, or feature; (iii) for any processing purpose other than the processing purpose that the controller disclosed at the time such controller collected such personal data or that is reasonably necessary for and compatible with such disclosed purpose; or (iv) for longer than is reasonably necessary to provide the online service, product, or feature. The bill prohibits, subject to a parental consent requirement, a data controller from collecting precise geolocation data from a known child unless (a) such precise geolocation data is reasonably necessary for the controller to provide an online service, product, or feature and, if such data is necessary to provide such online service, product, or feature, such controller shall only collect such data for the time necessary to provide such online service, product, or feature and (b) the controller provides to the known child a signal indicating that such controller is collecting such precise geolocation data, which signal shall be available to such known child for the entire duration of such collection. The bill prohibits a data controller from engaging in the activities described in the bill unless the controller obtains consent from the child's parent or legal guardian in accordance with the federal Children's Online Privacy Protection Act. This bill has a delayed effective date of January 1, 2025, and is identical to HB 707.

Consumer Data Protection Act; protections forchildren. Prohibits operators, defined in the bill, of websites,online services, or online or mobile applications from collectingor using the personal data of users they know are younger than theage of 18 without consent and prohibits the sale or disclosure ofthe personal data of such users.