On (and after) January 1st 2015, in two days’ time, California law SB 568 called “Privacy Rights for California Minors in the Digital World” will go into effect.
There are two main goals and subjects put forward in SB 568:
1. Section 22581 of SB 568 requires website and mobile app operators to permit minors – who are registered users of that said application – to remove or request removal of content or information posted on the operator’s app/site by the minor. Minors are defined under California law to include anyone under 18 (in contrast to COPPA that is a law designed to protect children below the age of 13). In contrast to COPPA, this is only a Californian law, but it potentially covers all sites targeting Californian minors, therefore potentially furthering its reach massively (if you believe California will go after you).
The law has been called “California’s Internet Eraser Law” elsewhere and has been called hard or impossible to follow in practice. It comes at a time when “the right to be forgotten” is being discussed in Europe.
2. Section 22580 of SB 568 forbids operators of an Internet Web site, online service, online application, or mobile application (the definition of web service) directed to minors to market or advertise certain products or services on their app/site. Among these products are alcoholic beverages, arms, tobacco and cigarettes and more.
New privacy notice rules for minors
The said rules regarding minors bring new requirements for privacy notices.
(1) Permit a minor who is a registered user of the operator’s Internet Web site, online service, online application, or mobile application to remove or, if the operator prefers, to request and obtain removal of, content or information posted on the operator’s Internet Web site, online service, online application, or mobile application by the user.
(2) Provide notice to a minor who is a registered user of the operator’s Internet Web site, online service, online application, or mobile application that the minor may remove or, if the operator prefers, request and obtain removal of, content or information posted on the operator’s Internet Web site, online service, online application, or mobile application by the registered user.
(3) Provide clear instructions to a minor who is a registered user of the operator’s Internet Web site, online service, online application, or mobile application on how the user may remove or, if the operator prefers, request and obtain the removal of content or information posted on the operator’s Internet Web site, online service, online application, or mobile application.
(4) Provide notice to a minor who is a registered user of the operator’s Internet Web site, online service, online application, or mobile application that the removal described under paragraph (1) does not ensure complete or comprehensive removal of the content or information posted on the operator’s Internet Web site, online service, online application, or mobile application by the registered user.
Sites directed to minors should therefore start to include notices to inform the users of their rights to remove or request the removal from that particular site. Also, they should advise the minors that this removal doesn’t ensure complete removal.
Exceptions for the removal requirement
Here’s the particular section for exceptions quoted in its entirety:
(b) An operator or a third party is not required to erase or otherwise eliminate, or to enable erasure or elimination of, content or information in any of the following circumstances:
(1) Any other provision of federal or state law requires the operator or third party to maintain the content or information.
(2) The content or information was stored on or posted to the operator’s Internet Web site, online service, online application, or mobile application by a third party other than the minor, who is a registered user, including any content or information posted by the registered user that was stored, republished, or reposted by the third party.
(3) The operator anonymizes the content or information posted by the minor who is a registered user, so that the minor who is a registered user cannot be individually identified.
(4) The minor does not follow the instructions provided to the minor pursuant to paragraph (3) of subdivision (a) on how the registered user may request and obtain the removal of content or information posted on the operator’s Internet Web site, online service, online application, or mobile application by the registered user.
(5) The minor has received compensation or other consideration for providing the content.
An operator is compliant with the rules if the content or information posted by the minor user no longer visible to other users of the service and the public even if the content or information remains on the operator’s servers in some form. Even if the original posting by the minor user is invisible, but it remains visible because a third party has copied the posting or reposted the content or information posted by the minor, the operator shall still be considered in compliance.
How does SB 568 impact sites in the US?
As with other preexisting laws regarding privacy online, SB 568 wants to protect Californian residents. This however doesn’t exclude sites from anywhere else in the States (or outside of it for that matter) as long as they target Californians.
The law can be found here and the corresponding discussion can be obtained here.
Use iubenda to generate your privacy notice
