(a) (1) Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens:(A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;(B) Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this personal information for targeted advertising to children or teens;(C) To collect the personal information of a child or teen except when the collection of the personal information is:(i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or(ii) Required or specifically authorized by law; or(D) To retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.(2) Neither an operator nor the operator's agent shall be liable for a disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subdivision (b)(3)(B) of this section to the parent of a child or to a teen under subdivision (b)(4)(C) of this section.
(1) Except as provided in subdivision (a)(2) of this section, it is unlawful for an operator of a website, online service, online application, or mobile application directed at children or teens or for any operator of a website, online service, online application, or mobile application with actual knowledge that it is collecting personal information from children or teens:(A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;(B) Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this personal information for targeted advertising to children or teens;(C) To collect the personal information of a child or teen except when the collection of the personal information is:(i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or(ii) Required or specifically authorized by law; or(D) To retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.
(A) To collect personal information from a child or teen in a manner that violates subsection (b) of this section;
(B) Except as provided in subdivisions (a)(1)(C) and (D) of this section, to collect personal information from a child or teen for purposes of targeted advertising to children or teens, or to allow another person to collect, use, disclose, or maintain this personal information for targeted advertising to children or teens;
(C) To collect the personal information of a child or teen except when the collection of the personal information is:(i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or(ii) Required or specifically authorized by law; or
(i) Consistent with the context of a particular service or the relationship of the child or teen with the operator, including without limitation collection that is necessary to fulfill a transaction or provide a product or service requested by the child or teen or parent of the child or teen; or
(ii) Required or specifically authorized by law; or
(D) To retain the personal information of a child or teen for longer than is reasonably necessary to fulfill a transaction or provide a service requested by the child or teen except as required for the safety or integrity of the service or specifically authorized by law.
(2) Neither an operator nor the operator's agent shall be liable for a disclosure made in good faith and following reasonable procedures in responding to a request for disclosure of personal information under subdivision (b)(3)(B) of this section to the parent of a child or to a teen under subdivision (b)(4)(C) of this section.
(b) An operator of a website, online service, online application, or mobile application that has actual knowledge that it is collecting personal information from children or teens shall:(1) Provide clear and conspicuous notice of:(A) What information is collected from children or teens by the operator;(B) The purpose for processing personal data;(C) The operator's disclosure practices for such information;(D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section;(E) The categories of personal data that the controller shares with third parties, if any; and(F) The categories of third parties, if any, with whom the controller shares personal data;(2) Obtain consent for the collection, use, or disclosure of personal information from the teen from the parent of a teen or a teen, except when the processing is for:(A) Providing or maintaining the specific product or service requested by the teen;(B) Conducting the operator's internal business operations, including without limitation identifying and repairing technical errors that impair existing or intended functionality;(C) Protecting against malicious, fraudulent, or illegal activity or detecting, responding to, or preventing security incidents or threats;(D) Investigating, establishing, exercising, preparing for, or defending legal claims;(E) Complying with federal, state, or local laws, rules, or regulations;(F) Complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or a summons by federal, state, local, or other governmental authorities;(G) Protecting the vital interests of a natural person; or (H) Providing or maintaining a specific product or service requested by the teen;(3) Provide:(A) The opportunity to:(i) Request at any time the deletion of the account of the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse at any time to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child; and(ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and(B) A means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if that personal information is available to the operator at the time the parent makes the request;(4) Provide:(A) The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;(B) The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and(C) A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the personal information is available to the operator at the time the teen makes the request;(5) Not require a child to disclose more personal information than is reasonably necessary as a condition to participate in:(A) A game;(B) The offering of a prize; or(C) Another activity; and(6) Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access.
(1) Provide clear and conspicuous notice of:(A) What information is collected from children or teens by the operator;(B) The purpose for processing personal data;(C) The operator's disclosure practices for such information;(D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section;(E) The categories of personal data that the controller shares with third parties, if any; and(F) The categories of third parties, if any, with whom the controller shares personal data;
(A) What information is collected from children or teens by the operator;
(B) The purpose for processing personal data;
(C) The operator's disclosure practices for such information;
(D) The rights and opportunities available to the parent of the child or teen under subdivisions (b)(3) and (b)(4) of this section;
(E) The categories of personal data that the controller shares with third parties, if any; and
(F) The categories of third parties, if any, with whom the controller shares personal data;
(2) Obtain consent for the collection, use, or disclosure of personal information from the teen from the parent of a teen or a teen, except when the processing is for:(A) Providing or maintaining the specific product or service requested by the teen;(B) Conducting the operator's internal business operations, including without limitation identifying and repairing technical errors that impair existing or intended functionality;(C) Protecting against malicious, fraudulent, or illegal activity or detecting, responding to, or preventing security incidents or threats;(D) Investigating, establishing, exercising, preparing for, or defending legal claims;(E) Complying with federal, state, or local laws, rules, or regulations;(F) Complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or a summons by federal, state, local, or other governmental authorities;(G) Protecting the vital interests of a natural person; or (H) Providing or maintaining a specific product or service requested by the teen;
(A) Providing or maintaining the specific product or service requested by the teen;
(B) Conducting the operator's internal business operations, including without limitation identifying and repairing technical errors that impair existing or intended functionality;
(C) Protecting against malicious, fraudulent, or illegal activity or detecting, responding to, or preventing security incidents or threats;
(D) Investigating, establishing, exercising, preparing for, or defending legal claims;
(E) Complying with federal, state, or local laws, rules, or regulations;
(F) Complying with a civil, criminal, or regulatory inquiry, investigation, subpoena, or a summons by federal, state, local, or other governmental authorities;
(G) Protecting the vital interests of a natural person; or
(H) Providing or maintaining a specific product or service requested by the teen;
(3) Provide:(A) The opportunity to:(i) Request at any time the deletion of the account of the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse at any time to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child; and(ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and(B) A means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if that personal information is available to the operator at the time the parent makes the request;
(A) The opportunity to:(i) Request at any time the deletion of the account of the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse at any time to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child; and(ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
(i) Request at any time the deletion of the account of the child or content or information submitted by the child to a website, online service, online application, or mobile application and to refuse at any time to permit the operator's further use or maintenance in retrievable form, or future online collection, of personal information from that child; and
(ii) Challenge the accuracy of the personal information and, if the parent of the child establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
(B) A means that is reasonable under the circumstances for the parent to obtain any personal information collected from that child, if that personal information is available to the operator at the time the parent makes the request;
(4) Provide:(A) The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;(B) The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and(C) A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the personal information is available to the operator at the time the teen makes the request;
(A) The opportunity at any time to delete personal information collected from the teen or content or information submitted by the teen to a website, online service, online application, or mobile application;
(B) The opportunity to challenge the accuracy of the personal information and, if the teen establishes the inaccuracy of the personal information, to have the inaccurate personal information corrected; and
(C) A means that is reasonable under the circumstances for the teen to obtain any personal information collected from the teen, if the personal information is available to the operator at the time the teen makes the request;
(5) Not require a child to disclose more personal information than is reasonably necessary as a condition to participate in:(A) A game;(B) The offering of a prize; or(C) Another activity; and
(A) A game;
(B) The offering of a prize; or
(C) Another activity; and
(6) Establish, implement, and maintain reasonable security practices to protect the confidentiality, integrity, and accessibility of personal information of children or teens collected by the operator, and protect the personal information against unauthorized access.
(c) Verifiable consent under subdivision (b)(2) of this section is not required in the case of:(1) Online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;(2) A request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;(3) Online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the online contact information and that it not be maintained in retrievable form;(4) The name of the child or teen and online contact information, to the extent reasonably necessary to protect the safety of a child or teen participant on the site:(A) Used only for the purpose of protecting such safety;(B) Not used to recontact the child or teen or for any other purpose; and(C) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form; or(5) The collection, use, or dissemination of such information by the operator necessary to:(A) Protect the security or integrity of its website;(B) Take precautions against liability;(C) Respond to judicial process;(D) Protect the security or safety of the user on the service; or(E) Provide information to law enforcement agencies or for an investigation on a matter related to public safety.
(1) Online contact information collected from a child or teen that is used only to respond directly on a one-time basis to a specific request from the child or teen and is not used to recontact the child or teen or to contact another child or teen and is not maintained in retrievable form by the operator;
(2) A request for the name or online contact information of a parent or teen that is used for the sole purpose of obtaining verifiable consent or providing notice under this section and where such information is not maintained in retrievable form by the operator if verifiable consent is not obtained after a reasonable time;
(3) Online contact information collected from a child or teen that is used only to respond more than once directly to a specific request from the child or teen and is not used to recontact the child or teen beyond the scope of that request if, before any additional response after the initial response to the child or teen, the operator uses reasonable efforts to provide a parent or teen notice of the online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the online contact information and that it not be maintained in retrievable form;
(4) The name of the child or teen and online contact information, to the extent reasonably necessary to protect the safety of a child or teen participant on the site:(A) Used only for the purpose of protecting such safety;(B) Not used to recontact the child or teen or for any other purpose; and(C) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form; or
(A) Used only for the purpose of protecting such safety;
(B) Not used to recontact the child or teen or for any other purpose; and
(C) Not disclosed on the site, if the operator uses reasonable efforts to provide a parent or teen notice of the name and online contact information collected from the child or teen, the purposes for which it is to be used, and an opportunity for the parent or teen to request that the operator make no further use of the information and that it not be maintained in retrievable form; or
(5) The collection, use, or dissemination of such information by the operator necessary to:(A) Protect the security or integrity of its website;(B) Take precautions against liability;(C) Respond to judicial process;(D) Protect the security or safety of the user on the service; or(E) Provide information to law enforcement agencies or for an investigation on a matter related to public safety.
(A) Protect the security or integrity of its website;
(B) Take precautions against liability;
(C) Respond to judicial process;
(D) Protect the security or safety of the user on the service; or
(E) Provide information to law enforcement agencies or for an investigation on a matter related to public safety.
(d) (1) An operator may terminate service provided to a child whose parent has refused or a teen who has refused under subdivision (b)(2) of this section to permit the operator's further use or maintenance in retrievable form or future online collection of personal information from that child or teen.(2) An operator shall not discontinue service provided to a child or teen on the basis of a request by the parent or the child or by the teen under subdivisions (b)(3)(A)(i) and (b)(4)(A) of this section to delete personal information collected from the child or teen, to the extent that the operator is capable of providing this service without the personal information.(3) A request made under subdivisions (b)(3)(A)(i) and (b)(4)(A) of this section to delete personal information of a child or teen shall not be construed to:(A) Limit the authority of a law enforcement agency to obtain any content or information from an operator under a lawfully executed warrant or an order of a court of competent jurisdiction;(B) Require an operator or third party to delete information that:(i) Another law requires the operator or third party to maintain; or(ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person; and(C) Prohibit an operator from:(i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;(ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of a person responsible for a security incident, identity theft, or fraud;(iii) Protecting the integrity or security of a website, online service, online application, or mobile application; or(iv) Ensuring that the child's or teen's personal information remains deleted.
(1) An operator may terminate service provided to a child whose parent has refused or a teen who has refused under subdivision (b)(2) of this section to permit the operator's further use or maintenance in retrievable form or future online collection of personal information from that child or teen.
(2) An operator shall not discontinue service provided to a child or teen on the basis of a request by the parent or the child or by the teen under subdivisions (b)(3)(A)(i) and (b)(4)(A) of this section to delete personal information collected from the child or teen, to the extent that the operator is capable of providing this service without the personal information.
(3) A request made under subdivisions (b)(3)(A)(i) and (b)(4)(A) of this section to delete personal information of a child or teen shall not be construed to:(A) Limit the authority of a law enforcement agency to obtain any content or information from an operator under a lawfully executed warrant or an order of a court of competent jurisdiction;(B) Require an operator or third party to delete information that:(i) Another law requires the operator or third party to maintain; or(ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person; and(C) Prohibit an operator from:(i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;(ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of a person responsible for a security incident, identity theft, or fraud;(iii) Protecting the integrity or security of a website, online service, online application, or mobile application; or(iv) Ensuring that the child's or teen's personal information remains deleted.
(A) Limit the authority of a law enforcement agency to obtain any content or information from an operator under a lawfully executed warrant or an order of a court of competent jurisdiction;
(B) Require an operator or third party to delete information that:(i) Another law requires the operator or third party to maintain; or(ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person; and
(i) Another law requires the operator or third party to maintain; or
(ii) Was submitted to the website, online service, online application, or mobile application of the operator by any person other than the user who is attempting to erase or otherwise eliminate the content or information, including without limitation content or information submitted by the user that was republished or resubmitted by another person; and
(C) Prohibit an operator from:(i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;(ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of a person responsible for a security incident, identity theft, or fraud;(iii) Protecting the integrity or security of a website, online service, online application, or mobile application; or(iv) Ensuring that the child's or teen's personal information remains deleted.
(i) Retaining a record of the deletion request and the minimum information necessary for the purposes of ensuring compliance with a request made under subsection (b) of this section;
(ii) Preventing, detecting, protecting against, or responding to a security incident, identity theft, fraud, or the reporting of a person responsible for a security incident, identity theft, or fraud;
(iii) Protecting the integrity or security of a website, online service, online application, or mobile application; or
(iv) Ensuring that the child's or teen's personal information remains deleted.
(e) Except as provided under this section and § 4-88-1605, a violation of subdivisions (b)(2) and (b)(3) of this section shall be treated as an unfair or deceptive act or practice prescribed under the Deceptive Trade Practices Act, § 4-88-101 et seq.