California’s New Age-Appropriate Design Code Act Imposes New Obligations on Businesses to Protect Children

First, the CAADCA has an affirmative requirement for businesses to assess how their Online Platforms may harm children and to create a plan to mitigate those harms and to ensure their Online Platforms’ default settings are appropriate for children.[4] The CAADCA requires businesses to do the following, among other things.

• Create Data Protection Impact Assessments. The CAADCA requires businesses to prepare a Data Protection Impact Assessment for any new Online Platforms likely to accessed by children.[5] A Data Protection Impact Assessment is a document that assesses the risk of harm a business’s online services, products, or features pose to children.[6] Specifically, businesses must assess:
  • • how the design of the Online Platform may expose children to harmful content, contacts, or conduct;[7]
    • how the design of the Online Platform may allow children to participate in harmful contacts or conduct;[8]
    • how algorithms used by the Online Platform may harm children;[9]
    • how targeted advertising systems used by the Online Platform may harm children;[10]
    • how the Online Platform may increase, sustain, or extend its own use;[11] and
    • how the Online Platform collects or processes children’s sensitive personal information.[12]

Businesses are required to make assessments available to the California attorney general upon written request.[13]

• Create Mitigation Plans. Businesses must also keep track of how risks that arise from their data management practices and create a timed plan to mitigate those risks prior to launch of an Online Platform.[14]
• Apply Protective Default Privacy Settings for Children. Businesses must estimate the age of child users of their online platforms.[15] Business must also configure default privacy settings for children at their most protective setting, unless the business can show that an alternative setting is the best interest of children.[16]
• Provide Tools to Exercise Privacy Rights and Report Concerns. Businesses must provide children tools to help them exercise their privacy rights and report concerns.[17]

Second, the CAADCA prohibits businesses from taking actions concerning their Online Platforms identified by the CAADCA as potentially harmful to children.[18] Business must not do the following, among other things.

• Improperly Use Children’s Personal Information. Businesses may not use a child’s personal information in a way that is harmful to a child.[19]
• Collect, Share, Sell, or Retain Unnecessary Personal Information. Businesses may not collect, sell, share, or retain any personal information that is not necessary to provide an Online Service with which a child is actively and knowingly engaged, unless the business can show doing so is in the best interests of children.[20]
• Secretly Collect Precise Geolocation Data by Default. Businesses may not collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.[21]
• Profile Children. A business may not profile a child except in limited circumstances.[22]
• Use Dark Patterns. A business may not use deceptive user interface design to trick children into providing more personal information than is reasonable, into foregoing privacy protections, or into doing anything that may harm children.[23]

Businesses that violate the CAADCA may be liable for damages of $2,500 per affected child for each negligent violation $7,500 per affected child for each intentional violation.[24]

この記事はThe Japan Practice Reportに掲載されました。The Japan Practice Reportを読む