On September 23, California Governor Jerry Brown signed into law a bill that will become the “Privacy Rights for California Minors in the Digital World” when it becomes effective on January 1, 2015. The bill, SB-568, has two sections which both purport to protect California residents under the age of 18: §22580 prohibits advertising certain high-risk items on sites directed to minors, and §22581 requires website operators to permit and enable minors to delete content they posted.
California is the first state to impose these obligations on site operators, and the law leaves a lot of questions unanswered for operators who may need to comply. The law applies to operators who have “actual knowledge” that a minor is using their web site, online services/application, or mobile application, or to operators of such sites that are “directed to minors”, and prohibits these operators from collecting “personal information” for the purpose of advertising restricted items.
The restriction on advertising seems to combine some sentiments of the federal Children’s Online Privacy Protection Act (COPPA) with elements of the Do Not Track movement, but the California law leaves many terms undefined. The COPPA rules have been promulgated with extensive guidance to help operators determine whether their site is directed towards children under the age of 13. This law requires operators to make a much more nuanced decision – is their site “directed to minors” if their target audience includes older teenagers? How is an operator to know whether their audience includes California minors? For now, the COPPA rules probably provide the best guidance for operators, at least until the California Attorney General provides further guidance. The uncertainty and debate about the law’s applicability will continue, but the legislature made sure to clearly list the prohibited products and services, which include: alcohol, guns, spray paint, tobacco products, tanning beds, drug paraphernalia, and lottery tickets.
The more heavily criticized section of the bill has been called the “online eraser” or “delete button” law, which similarly applies to operators of sites that are “directed to minors”. This section imposes four requirements on operators in regards to registered users who are California minors:
- Permit these users to remove (or request and obtain removal of) content the user posted (and only that the user has posted – there is no protection for content posted or re-posted by third-parties);
- Provide notice to these users that removal is possible;
- Post clear instructions for removal process; and
- Explain to these users that this removal process doesn’t ensure comprehensive removal of the content from the web.
Operators will be deemed compliant even if the content remains on their servers, as long as it is no longer visible to the public or other users of the site. The law also seems to acknowledge the technical and logistical difficulties of removal by including several exceptions to the requirement; operators do not have to comply if:
- The user does not follow their posted removal process,
- If they are able to anonymize the content so the user is no longer personally identifiable,
- If the content is posted by a third-party,
- If the minor has received compensation for the content, or
- If the operator is required to maintain the posting by other state or federal law.
Nonetheless, just as with the restriction on advertising, there are many unanswered legal and technical questions. Would operators need to edit photos in order to anonymize a user? What if the user who posted it is not personally identifiable in the photo, but nonetheless requests its removal? Eric Goldman, a blogger and professor at Santa Clara University School of Law, raised the issue of when the minor must exercise this removal right – does it have to be while they are still a minor? Is there a statute of limitations on this right? He also emphasized that this law is only creating an illusion of control for minors:
Given how often publicly available content gets copied elsewhere on the Internet – especially when it’s edgy or controversial – minors’ purported control over the content they post will be illusory in most circumstances.
Since California often sets the bar for novel internet regulation, some are predicting that other states (and perhaps even the FTC) will adopt some version of these protections. Operators of sites or services that could be construed as “directed to minors” should be aware of the potential obligations to determine which registered users would be covered by the law and consider how to comply in a timely and cost-effective manner. However, with more than two years before the law becomes effective, there is still plenty of time for legal challenges in the courts or other legislation to take hold.
