In our last look at state regulation of companies’ interactions with children, we look at changes to state “comprehensive” privacy laws. These are amendments or overlays to existing comprehensive state privacy laws that add special obligations when processing children’s data. Obligations include requiring impact assessments if processing kids’ information or restricting targeted advertising. Also covered are bans on the sale of minors’ data.
Unlike stand-alone laws, these seem to have more staying power. They include:
- California: starting January 1, 2026 includes information collected from children under the age of 16 as “sensitive personal information” and thus subject to risk assessments
- Colorado: beginning October 1, 2025 requires impact assessments when engaged in high-risk processing of children’s data
- Connecticut: beginning July 1, 2026 will require impact assessments and ban the sale of minors’ data
- Montana: From October 1, 2025 requiring impact assessments and restrictions on targeted advertising to those under 16 or 18
- Oregon: beginning January 1, 2026 prohibits sale of minors’ data (namely, precise geolocation data) and
- Virginia: starting January 1, 2026 required data protection assessment for online operators when engaged in high-risk processing of minors’ data
Putting It Into Practice: These evolving laws underscore the need to adapt to a patchwork of requirements. While we anticipate ongoing challenges, legislators are continuing to draft new or revised laws. A principles-based approach can help in this shifting environment.
