Can I skip updating my privacy policy and other CCPA-related documents in New York? What are the requirements?

Requirements for Updating Privacy Policy and CCPA-related Documents in New York

If you offer an online product targeted towards child users in New York, you cannot skip updating your privacy policy and other CCPA-related documents. The New York Child Data Privacy and Protection Act requires all entities offering an online product targeted towards child users in New York to comply with specific requirements to protect the personal data of children under the age of 18 who access online products with a device.

The act requires all entities offering an online product targeted towards child users in New York to comply with the following requirements:

1. Privacy Policy and Terms of Service: Any entity offering an online product targeted towards child users in New York shall prominently display a privacy policy and terms of service, to include warnings about potential harms to child users, in a manner which clearly and concisely communicates to a child user, using language likely to be understood by an individual in the age range targeted by such product.
2. Privacy by Default: All entities offering an online product targeted towards child users in New York shall utilize privacy by default, unless the entity can demonstrate a compelling reason to the bureau that an alternative default setting should be used.
3. Proactive Alerts: All entities offering an online product targeted towards child users in New York must design and activate a feature which proactively alerts child users, in a manner likely to be understood by a child in the age range targeted by the online product, when their personal data is being collected and for the duration of time such collection occurs.
4. Bureau Discretion: The bureau shall have the discretion to ban auto-play, push notifications, prompts, in-app purchases, or any other feature in an online product targeted towards child users that it deems to be designed to inappropriately amplify the level of engagement a child user has with such product.
5. Deceased Child Users: All entities offering an online product targeted towards child users in New York shall provide access to such user’s account, metadata, and user history to a parent or legal guardian upon the death of such child user and request from such parent or guardian for such access.
6. Law Enforcement: All entities offering an online product targeted towards child users in New York shall expedite and prioritize civil and criminal subpoenas and criminal warrants pertaining to child users who have been a victim of a crime with maximum exigence.

Failure to comply with the requirements of the New York Child Data Privacy and Protection Act may result in penalties and fines.

Source(s):

• [2] Relates to enacting the New York child data privacy and protection act [SAME AS S03281]

Jurisdiction

New York

• Privacy