Chapter 6: State Comprehensive Privacy Laws
Opt-In Default for Children's Data
Age-based opt-in rules vary: California requires opt-in to sell/share data of consumers under 16; Connecticut requires opt-in for ages 13-16 to sell or target-advertise; Utah requires opt-in to process data of under-13; and Colorado, Connecticut, Virginia treat under-13 data as sensitive (opt-in).
| State | Requirement | |
|---|---|---|
| California | Opt-in consent to sell or share personal information of consumers under 16 | - |
| Connecticut | Opt-in consent for consumers under 16 (at least 13) to sell or process for targeted advertising; under-13 data is sensitive (opt-in) | |
| Colorado, Virginia | Treat under-13 data as sensitive personal information, requiring opt-in to process | |
| Utah | Opt-in consent to process personal information of consumers under 13 |
These provisions interact with COPPA, the federal children's privacy law, since parental consent is likely required for children under 13.
Watch the age thresholds
California: under 16 (sell/share). Connecticut: 13-16 (sell or targeted advertising), with under-13 as sensitive. Utah: under 13 (processing). Mixing up the age cut-offs is a common exam trap.
Key terms - quick answers
What is “Opt-in default for children's data”?
An age-based requirement that a business obtain consent before handling a minor's data in specified ways; thresholds and triggers vary by state.
What is “COPPA”?
The federal Children's Online Privacy Protection Act, referenced because parental consent is generally required for children under 13.