Online service, product, or feature: access by children., the official text

An act to add Chapter 22.1.5 (commencing with Section 22583) to Division 8 of the Business and Professions Code, relating to business.

LEGISLATIVE COUNSEL'S DIGEST

Existing law, the California Age-Appropriate Design Code Act, requires a business that provides an online service, product, or feature likely to be accessed by children to comply with certain requirements, including, among other things, prohibiting the business from profiling a child by default or using personal information for any reason other than the reason for which that information was collected, except as specified. Existing law imposes specified civil penalties upon a business that violates these provisions.
This bill would impose similar provisions without the above-referenced exceptions and would impose civil penalties for a violation of these provisions.

The people of the State of California do enact as follows:

SECTION 1.
Chapter 22.1.5 (commencing with Section 22583) is added to Division 8 of the Business and Professions Code, to read:
22.1.5.
Online Services, Products, or Features Likely to be Accessed by Children22583.
(a) For purposes of this chapter, the definitions in Section 1798.140 of the Civil Code shall apply unless otherwise specified in this chapter.
(b) For the purposes of this chapter:
(1) “Child” or “children,” unless otherwise specified, means a consumer or consumers who are under 18 years of age.
(2) “Default” means a preselected option adopted by the business for the online service, product, or feature.
(3) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
(A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.
(4) “Online service, product, or feature” does not mean any of the following:
(A) A broadband internet access service, as defined in Section 3100 of the Civil Code.
(B) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
(C) The delivery or use of a physical product.
(5) “Profiling” means any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

22583.1.
(a) A business that provides an online service, product, or feature likely to be accessed by children shall take all of the following actions:
(1) Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business pursuant to subdivision (b) of Section 1798.501 of the Civil Code or apply the privacy and data protections afforded to children to all consumers.
(2) Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy.
(3) Provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access that online service, product, or feature.
(4) If the online service, product, or feature allows the child’s parent, guardian, or any other consumer to monitor the child’s online activity or track the child’s location, provide an obvious signal to the child when the child is being monitored or tracked.
(5) Provide prominent, accessible, and responsive tools to help children, or if applicable their parents or guardians, exercise their privacy rights and report concerns.
(b) A business that provides an online service, product, or feature likely to be accessed by children shall not take any of the following actions:
(1) Use the personal information of any child in a way that the business knows, or has reason to know, will cause an average child likely to access the online service, product, or feature either of the following harms:
(A) Significant mental suffering or distress that may, but does not necessarily, require medical or other professional treatment or counseling.
(B) Discrimination against the child on the basis of race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.
(2) Profile a child by default.
(3) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature with which a child is actively and knowingly engaged, or as described in subparagraphs (A) to (D), inclusive, of paragraph (1) of subdivision (a) of Section 1798.145 of the Civil Code.
(4) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected.
(5) Collect, sell, or share any precise geolocation information of children by default unless the collection of that precise geolocation information is strictly necessary for the business to provide the service, product, or feature requested and then only for the limited time that the collection of precise geolocation information is necessary to provide the service, product, or feature.
(6) Collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.
(7) Use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections.
(8) Use any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age. Age assurance shall be proportionate to the risks and data practice of an online service, product, or feature.
(c) Nothing in this section shall be construed to require a business to prevent or preclude a child from accessing or viewing any piece of media or category of media.

22583.2.
(a) Any business that violates this chapter shall be subject to an injunction and liable for a civil penalty of not more than five thousand dollars ($5,000) per affected child for each negligent violation or not more than fifteen thousand dollars ($15,000) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.
(b) Any penalties, fees, and expenses recovered in an action brought under this chapter shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160 of the Civil Code, with the intent that they be used to fully offset costs incurred by the Attorney General in connection with this chapter.
(c) Nothing in this chapter shall be interpreted to serve as the basis for a private right of action under this chapter or any other law.
(d) The Attorney General may solicit broad public participation and adopt regulations to clarify the requirements of this chapter.

22583.3.
This chapter does not apply to the information or entities described in subdivision (c) of Section 1798.145 of the Civil Code.

22583.4.
The provisions of this chapter are severable. If any provision of this chapter or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.