Minor data protection

Use age-category data received from the app store only to enforce developer-created age-related restrictions/defaults, ensure legal compliance, or implement safety features; do not share age-category data with any person.

Do not use a child's personal information in ways materially detrimental to the child's well-being, profile a child by default, or collect/share/retain more of a child's data than necessary.

Statute’s own ages: Applies to users under 18.

Do not request more information than necessary to comply with the Act, and do not share the age signal with a third party for any purpose the Act does not require.

Without consent (from the minor, or a parent/guardian for a minor under 13), do not process a minor's personal data for targeted advertising, sale, or profiling in furtherance of decisions with legal or similarly significant effects; do not collect precise geolocation except as needed to provide the service; and do not use a system design feature to significantly increase, sustain, or extend the minor's use of the service.

Statute’s own ages: Applies to minors under 18; consent is parental for under-13 and the minor's own for 13-17.

Do not process a minor's personal data for targeted advertising or for sale (a categorical ban after SB 1295), restrict profiling and secondary uses, limit precise-geolocation collection, and do not use a system design feature to significantly increase, sustain, or extend a minor's use of the service.

Statute’s own ages: Applies to minors under 18; SB 1295 made the targeted-advertising and sale limits categorical rather than consent-based.

Use age-verification data received through app-store APIs only for compliance, and delete it after the age category is determined.

Statute’s own ages: Applies to data about any minor (under 18)

Do not process a minor's personal data unless reasonably necessary to provide the specific product the child is actively and knowingly engaged with, and do not process it in ways that conflict with the child's best interests.

Statute’s own ages: Applies to users under 18.

For a consumer the controller knows or willfully disregards is a minor (under 18), use reasonable care to avoid a heightened risk of harm to the minor, and do not process the minor's personal data for targeted advertising, sale, or profiling with legal/significant effects without consent: consent for ages 13-17, or verifiable parental consent for under 13.

Statute’s own ages: Minor = under 18. Consent required from the minor for ages 13-17; verifiable parental consent for under 13. The 'heightened risk of harm' duty of care applies to all known minors under 18.

Collect only the minimum personal data necessary to provide the service the minor requests; restrict profiling except where strictly necessary, limit precise-geolocation sharing with notice, and do not deliver targeted advertising to minors.

Statute’s own ages: Applies to minor account holders; precise age scope pending primary-text verification.

For a consumer the controller has actual knowledge is, or willfully disregards whether the consumer is, under 16 years of age, do not sell the consumer's personal data, process it for targeted advertising, or profile the consumer in furtherance of decisions that produce legal or similarly significant effects. Unlike prior OCPA law, which allowed these activities with the consumer's (or a parent's) consent, HB 2008 prohibits them outright; consent is no longer a permission.

Statute’s own ages: Applies to consumers under 16, i.e., the entire population below 16 (both under-13 and 13–15). This both raises the prior OCPA's 13–15 band up to under-16 and removes the consent exception that previously permitted these activities.

Do not use a known minor's personal data to target advertising, and limit collection of a known minor's personal information to what is reasonably necessary.

Statute’s own ages: Minor = under 18

Use the age-category data received from the app store only to enforce age-related restrictions, comply with law, or implement safety features.

Do not collect, use, or retain a minor's personal data beyond what is necessary to provide the specific service the minor is engaged with, and do not process it in ways that materially conflict with the minor's wellbeing.

Statute’s own ages: Applies to 'minors' under 18; the Act does not sub-tier this duty by age.