Does the CCPA require opt-in consent to sell a minor's personal information?

The CCPA does not treat every consumer's data the same way when it comes to selling or sharing it. Age changes who gives consent, and the regulations draw that line at two specific points: 13 and 16.

Under 13: a parent or guardian has to opt in

11 CCR Section 7070(a)(1) requires a business with actual knowledge that it sells or shares the personal information of a consumer under 13 to establish, document, and comply with a reasonable method for determining that the person consenting to the sale or sharing is actually the child's parent or guardian. This consent sits on top of, not instead of, any verifiable parental consent already required under the federal Children's Online Privacy Protection Act.

Section 7070(a)(2) lists what counts as a reasonable method: a signed consent form returned by postal mail, fax, or electronic scan; a monetary transaction using a credit card, debit card, or other payment system that notifies the primary account holder of the specific transaction; a toll-free call to trained personnel; a video conference with trained personnel; an in-person conversation with trained personnel; or checking a government-issued ID against an identity database, as long as the ID is deleted from the business's records promptly once verification is complete.

Section 7070(b) adds a disclosure duty once consent is obtained: the business must tell the parent or guardian about their right to opt out of the sale or sharing later, and how to exercise it under Section 7026, on the child's behalf. Section 7070(c) extends the same reasonable-method standard to a request to delete, correct, or know a child's personal information: a business has to be satisfied the person asking is actually the parent or guardian before acting on it.

13 to 15: the consumer consents for themselves

The rule shifts at the next age band. 11 CCR Section 7071(a) requires a business with actual knowledge that it sells or shares the personal information of a consumer at least 13 and under 16 to establish a reasonable process letting that consumer, not a parent, opt in to the sale or sharing of their own information, following the opt-out preference signal procedures in Section 7028.

Section 7071(b) adds the matching disclosure once that consumer opts in: the business has to inform them of their ongoing right to opt out of the sale or sharing at any point in the future, and the process for doing so under Section 7026. Consent at this age band is not a one-time door that locks behind the consumer. It comes with a standing right to walk back out.

The notice duty that wraps around both rules

11 CCR Section 7072(a) requires a business subject to Sections 7070 and 7071 to describe those processes in its privacy policy. If you sell or share data belonging to consumers under 16 at all, this is not optional background information. It has to be written down where consumers, and regulators, can read it.

Section 7072(b) carves out one narrow exception. A business that exclusively targets its offers of goods or services directly to consumers under 16, and does not sell or share their personal information without the consent required by Sections 7070 and 7071, is not required to provide the separate Notice of Right to Opt-out of Sale/Sharing that other businesses must post. The logic is straightforward: if consent is already required before any sale or sharing happens, a standing opt-out notice adds little, so the regulation does not demand it from a business built that way from the start.

Why "actual knowledge" is the trigger, not age-verification duties generally

Both Section 7070 and Section 7071 are triggered by the business's actual knowledge of the consumer's age, not by a freestanding duty to verify every user's age before collecting data. A business that does not knowingly sell or share minors' data does not need to build the consent infrastructure these sections describe. The moment actual knowledge exists, whether from account information, platform design, or anything else that puts the business on notice, the age-appropriate consent duty attaches.

This sits alongside the CCPA's general Do Not Sell or Share right and Global Privacy Control handling, which apply to consumers of any age. The minors' rules in Sections 7070 through 7072 add a consent requirement in front of the sale or sharing itself, rather than replacing the ordinary opt-out mechanics once consent has been given.

Next step

If your business has any reasonable basis to know it holds data belonging to consumers under 16, and that data is sold or shared in any form, including through advertising partnerships, the free 2-minute Obligation Scan flags the consent and notice duties that attach at each age band, so a gap in parental or minor consent does not surface for the first time in a complaint.