I'm not a lawyer, but considering the California government probably intended for this law to protect California's children's data, it's possible a court would conclude California has jurisdiction should the AG pursue any company that has a child who lives in California, regardless of where the company is located.
I'm only a software engineer, but I'm not sure I completely agree with the analysis.
Upon my reading of the law, it seems that the application having just one user under 18 is not sufficient to establish the applicability of the act. Rather, the applicability of the law is to be judged on a case-by-case basis. To quote the law:
"(4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
(A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
(B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
(C) An online service, product, or feature with advertisements marketed to children.
(D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
(E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
(F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children."
In general, I would guess that a company that, by complete accident, has a child user would not be subject to this new law.
Techdirt has not posted any stories submitted by Montana Burr.
I'm not a lawyer, but considering the California government probably intended for this law to protect California's children's data, it's possible a court would conclude California has jurisdiction should the AG pursue any company that has a child who lives in California, regardless of where the company is located.
Minor correction?
I'm only a software engineer, but I'm not sure I completely agree with the analysis. Upon my reading of the law, it seems that the application having just one user under 18 is not sufficient to establish the applicability of the act. Rather, the applicability of the law is to be judged on a case-by-case basis. To quote the law: "(4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children: (A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.). (B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children. (C) An online service, product, or feature with advertisements marketed to children. (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B). (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children. (F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children." In general, I would guess that a company that, by complete accident, has a child user would not be subject to this new law.