The California Delete Act (SB 362) is one step closer to becoming law in California. We are sponsoring this landmark bill to addresses common and pervasive problems posed by data brokers – companies that operate in the shadows, collecting, selling, and sharing personal information without people’s knowledge or consent. One area of particular concern is children’s data.
Current Privacy Laws Are Not Sufficient
Data brokers typically do not gather information from individuals themselves, but rather from other sources. This means that even with existing laws in place, such as the Children’s Online Privacy Protection Act (COPPA) and the California Consumer Privacy Act (CCPA), parents and guardians face significant challenges identifying data brokers and requesting deletion of a child’s information.
COPPA offers some safeguards for children under 13. It requires parental consent before a company may collect, use, or disclose a child's information online. The California Consumer Privacy Act (CCPA) provides a right to delete, but that right is limited to information collected from a person. This means that parents who wish to request their child’s information be deleted from data brokers must go to the list of registered data brokers in California (of which there are approximately 500), research whether that data broker offers a means to opt out, and individually submit opt-out requests for each company. This presents parents with an insurmountable up-hill battle to have their information and that of their children deleted from data brokers.
Data Brokers and Children: A Perilous Intersection
Data brokers build comprehensive profiles of individuals, collecting data ranging from internet browsing patterns to location information to far more invasive and often sensitive categories. Recent reporting from The Markup, for example, identified that a single advertising data broker, Xandr, contains more than 2,200 different audience segmentations for “kids”, and an additional 4,700 ways to target “children.” From identifying and targeting purchasers of kids products, parents of young children, homeschoolers, summer school attendees, children with “obstacles” to learning, socioeconomic factors and much more – data brokers are collecting massive quantities of often sensitive information and making inferences about children and their families. In the case of children, this data mining can start almost from birth, tracing their digital footprints as they grow and mature. The fallout from these activities can have serious, sometimes lifelong implications.
Identity Theft
Stolen children's identities are a lucrative black-market commodity, and child identify theft is increasingly common. According to a Javelin report, in 2021, 1 in 50 U.S. children were victims of identity theft; children may be as much as 51 times more vulnerable to identity theft than their parents. Identity thieves can use a child's pristine credit history to take out loans, secure credit cards, or commit various forms of fraud. Often, these transgressions go unnoticed until the child enters adulthood, at which point they find themselves grappling with a tarnished credit history they didn't create.
Data brokers significantly contribute to this rising trend of identity theft. They collect and consolidate vast amounts of personal information, creating rich and detailed profiles that, in the wrong hands, can be exploited for fraudulent activities. These brokers sell data to third parties, sometimes with insufficient verification of the buyer's intent, opening up avenues for potential misuse. Moreover, the security measures employed by data brokers are not always robust enough to prevent data breaches, leading to large-scale exposure of sensitive information. The long-term storage of such data also amplifies the risks, as the longer information is kept, the greater the chances of it falling prey to security breaches.
Targeted Advertising
Data brokers also play a central role in targeted and surveillance-based advertising, often promoting unhealthy habits. For example, children may be bombarded with ads for junk food, age-inappropriate content, or goods that encourage poor financial habits. These types of ads can influence a child's development and lifestyle choices, potentially leading to negative health and social outcomes.
Data brokers' ability to create thorough consumer profiles also allows for sophisticated targeted advertising of parents and even manipulative marketing practices. Parents often find themselves bombarded with advertisements based on their financial status, health conditions, or personal interests. This can lead to privacy invasion, unnecessary spending, and increased susceptibility to scams or predatory lending practices.
Profiling and Potential Discrimination
Profiling can lead to unfair targeting and discrimination, shaping a child's future in ways they, and their parents, may not even be aware of. Data indicating potential learning difficulties or behavioral issues could lead to unfair treatment or bias in educational settings or later employment.
Impact on Mental Health
Finally, it's vital not to overlook the psychological impacts of pervasive data collection. Knowing, or even suspecting, that they are constantly watched and analyzed, children may feel their privacy is violated, leading to feelings of anxiety, and potentially inhibiting their personal and social development.
The Delete Act: A Step Towards Comprehensive Protection
Almost by definition, data brokers’ activities occur without a person’s explicit consent—in most cases they collect and sell personal information without an individual ever knowing they exist. Individuals’ most intimate information are all exposed and traded like a commodity. The Delete Act is designed to address this head-on.
By requiring every registered data broker to comply with a mechanism to delete personal information upon request, it would empower parents to gain more control over their family’s information. The Delete Act also mandates that data brokers disclose what type of information they collect, and particularly when they collect children’s information—promoting transparency.
Privacy is a fundamental human right, and it is a constitutional right in California. However, the Delete Act's aim is not solely to protect individual privacy rights, but also to reduce the risk of financial fraud, predatory practices, and discrimination resulting from unregulated data collection and trade. We are hopeful for a more secure and equitable future where children's digital lives are protected rather than exploited.
