California’s New Age Verification Rule May Expose Its Vulnerable Population

California passed a new law requiring online platforms like Instagram, YouTube and TikTok, as well as online services, products or features accessed by children to install guardrails for users under 18. The law, called the California Age-Appropriate Design Code Act (CAADCA), also prohibits online sites likely accessed by children from using their personal information, collecting their location data or profiling them. It requires websites and apps to estimate the age range of its audience, implementing higher privacy settings where needed. The age authentication process—which is yet to be decided, but could lead to users under 18 required to provide their personal ID every time they wish to visit a website—has concerned privacy experts who deem it interrogative. This “might expose data associated with vulnerable populations such as the LGBTQ+ community, whistleblowers or even journalists that might want to retain some level of anonymity," said Ari Lightman, a professor of digital media, marketing and cybersecurity at Carnegie Mellon University's Heinz College. Flo’s Anonymous Mode Is a Small Win in Protecting People's Privacy California currently spearheads a myriad of privacy-driven laws including the CCPA and CPRA. However, the age-appropriate law, riddled with unclear rules, comes with potential data pitfalls and more fines. Meanwhile, it limits an advertiser’s capability to understand and target a younger cohort. California's law emulates a U.K. law that prompted some changes by tech giants but had a limited impact on its online landscape. "It is an important development towards establishing these standards," a Meta spokesperson told Adweek. However, the tech giant is concerned about some of the provisions under California's law. Meanwhile, with its "Best Interest of the Child" framework, Meta is able to inform on how to build age-appropriate experiences across its platforms. The CAADCA comes into effect on July 1, 2024. Nebulous language can expose vulnerable data The law mandates all companies that conduct business in California on the internet to have their internal data privacy audits externally reviewed by the California Attorney General. If the quality of the internal data privacy audit doesn’t adequately parse the risks to children, and if the business violated provisions of CAADCA, civil fines ranging from $2,500 to $7,500, per child impacted, can be imposed on that business. However, the law in its current form does not elicit how businesses that interact with users under 18 can verify their age, nor does it stipulate the basis on which regulators can audit these companies on the data collected, leaving companies open to the risk of fines. This was recently seen in Sephora's $1.2 Million CCPA settlement where the company's point of contention came from the loose definition of the term “sale” under the law. “The law is good in intent and bad in execution,” said Lightman, adding the repercussions of such nebulous language can also result in malicious intent. For example, if a person under the age of 18 is to provide an ID to access a site, this might expose their personal details to the state and law enforcement who can easily retrieve this information from such companies. This is especially concerning with the Dobbs ruling, where states with abortion restrictions can access personal information from a variety of different platforms in a situation where somebody plans to seek an abortion in another state, and consequently return to that state to face prosecution, Lightman noted. Advertisers are limited in targeting capabilities The law will affect advertisers similarly to how Apple's iOS changes have impacted Facebook and Instagram advertising, according to cybersecurity company Agency co-founder and CEO Amir Tarighat, in as much as tracking demographic and interest ad groups will be a challenge. “This [would] make conversion tracking and attribution harder,” he said. While advertisers will miss out on how to better understand these audiences, it demands a new set of skills within the industry to think innovatively on data prediction, collection and interpretation, said Lightman, especially if that data is not available. However, companies who want to use the personal information of young people are required to write down and explain any “compelling reason” they want to use that information. To that, the written explanation within a Data Protection Impact Assessment (DPIA) must be made available within five business days to the California Attorney General if it’s requested. The DPIA mandated by the law prior to product releases that could impact anyone under the age of 18, will slow down some of the growth hacks released by big tech, according to Zach Edwards, a data supply chain researcher. Still, the California Attorney General needs to provide more guidance and auditing templates for businesses to conduct accurate assessments. "Because as it stands, most businesses are unaware of what to include in a DPIA and what could get them in trouble for not including," said Edwards. "And we need to bridge that information gap as soon as possible. Nonetheless, California thanks to CCPA, CPRA and now the age-appropriate law, has a combination of strong privacy protections. “We could see a huge influx of technically-sound implementations of data-consent walls,” said Edwards, where CAADCA prompts "could end up making GDPR cookie prompts look quaint." Watch Out B-to-B Companies, Your CCPA Data Exemption Has an Expiration Date