CCPA and Minors: AI Opt-In Consent Rules for Under-16 Data (2026)
For adults, CCPA runs on opt-out — you can sell or share their data until they tell you to stop. For minors under 16, the default flips: you can't sell or share their personal information unless they (or a parent) affirmatively opt in. AI products make this harder, because a model that infers age or profiles behavior can give you the "actual knowledge" that triggers the rule — whether you asked for a birthday or not.
The Rule: Opt-In, Not Opt-Out, for Minors
CCPA (as expanded by CPRA) prohibits a business from selling or sharing the personal information of a California consumer if the business has actual knowledge the consumer is under 16, unless it has affirmative authorization. The consent tiers are:
- Under 13 — a parent or guardian must affirmatively authorize the sale or sharing.
- 13 to 15 — the minor consumer must affirmatively authorize it themselves.
- 16 and older — the standard opt-out ("Do Not Sell or Share My Personal Information") model applies.
"Sharing" is the word most teams miss. It captures disclosing personal information to a third party for cross-context behavioral advertising — even without payment. If your AI app runs ad pixels or passes teen-level behavioral data to an ad network, that's sharing, and the opt-in requirement applies.
"Actual Knowledge" and Willful Disregard — the AI Problem
The obligation triggers on actual knowledge that a user is under 16. Critically, CCPA says a business that willfully disregards a consumer's age is deemed to have actual knowledge. AI changes the calculus in three ways:
The safest posture is not "avoid knowing." It's to build an age signal you can act on, then apply the correct consent tier when a user is under 16 — and to keep minors' data out of any sale/share pipeline by default.
CCPA vs COPPA: They Stack
Teams frequently assume COPPA "covers" children's privacy and stop there. The two laws address different acts and overlap for AI products serving California minors:
An AI study tool used by a 12-year-old Californian can owe COPPA parental consent for collection and CCPA's under-13 parental opt-in before any sharing. Complying with one does not discharge the other.
Minor-Data Compliance Checklist for AI Products
- Know your audience. Assess honestly whether under-16 users are likely. If yes, you need an age mechanism — you can't opt out of the question.
- Default minors out of sale/share. Suppress ad pixels, third-party behavioral sharing, and data brokering for any user flagged or inferred under 16 until valid opt-in exists.
- Build tiered consent. Parental authorization flow for under-13; a clear teen opt-in for 13–15; standard opt-out link for 16+.
- Govern age inferences. If your model estimates age, route that output into your privacy logic — don't let it exist only in the product layer.
- Document everything. Record how consent was obtained and when. Consent you can't evidence is consent you don't have.
- Layer COPPA where under-13 data is collected. Verifiable parental consent, data minimization, and a child-directed privacy notice.
Frequently Asked Questions
We don't 'sell' data — do the minor rules still apply to us?
They apply if you sell OR share. Sharing includes disclosing personal information to third parties for cross-context behavioral advertising, even without payment. Most AI apps that run ad or analytics pixels are sharing under CCPA's definition, which pulls the under-16 opt-in requirement into play.
Our app is for adults, but some teens use it anyway. Are we liable?
The trigger is actual knowledge, including willful disregard. If your product is genuinely adult-oriented and you don't have signals indicating a user is under 16, the obligation may not attach. But if your AI infers age, or the context makes teen use obvious, ignoring that can be treated as willful disregard — which the statute deems to be actual knowledge.
Does deleting minors' data solve the problem?
Deletion helps with data minimization and honoring deletion rights, but it doesn't substitute for consent. The core rule is about sale/sharing: even data you retain lawfully cannot be sold or shared for an under-16 consumer without the correct opt-in. Suppression from sale/share pipelines is the operative control.
How is age-16 status different from age-13 under CCPA?
Both fall under the opt-in rule, but the consenting party differs. For consumers under 13, a parent or guardian must authorize the sale/share. For consumers 13 to 15, the minor may authorize it themselves. At 16, the consumer is treated like an adult for this purpose and the standard opt-out model applies.
Treat Age as a First-Class Privacy Signal
The teams that get caught by CCPA's minor rules are the ones that treated age as a growth question ("can teens use our AI?") but never a compliance question ("do we know who's under 16, and are we keeping their data out of every sale and share?"). Those are the same fact — wire the age signal into your privacy logic, not just your product.
Start with a data map: where teen users enter, what your AI infers about them, and every third party that receives their data. Default minors out of sale and sharing, then build the tiered opt-in on top.