CAADCA Section 1798.99.31(b)(2) - No profiling of a child by default (enjoined)

Where this comes from

Who it applies to

What engineering work it implies

Related obligations

Where the same control satisfies more than one framework — comply once, cover many.

• Brazil LGPD — Children's ProvisionsHarmonized
  Prevent prohibited profiling and related techniques in commercial advertising to under-18sECA Digital Arts. 22 and 26 - commercial advertising to children and adolescents
• EU Digital Services ActRelated
  In-scope online platforms using recommender systems MUST explain the main parameters and any options available for recipients to modify or influence them. Where several ordering options are available, provide functionality to select and modify the preferred option. Article 27 does not itself require creating a non-profiling option; assess Article 38 separately for designated VLOPs/VLOSEs.DSA Article 27 — Recommender system transparency
• EU GDPR Children's Provisions (Article 8)Harmonized
  Solely automated decisions with legal or similarly significant effects are prohibited unless an Article 22(2) ground applies; where the ground is contract necessity or explicit consent, the Article 22(3) safeguards must be in place and effective for a childArticle 22 - Automated individual decision-making, including profiling (where the data subject is a child)
• UK Age Appropriate Design CodeEquivalent requirement
  Disable profiling by default; only permit with harm-protection measures in placeStandard 12 — Profiling (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)
• UK Age Appropriate Design CodeHarmonized
  Document harm-protection measures where child profiling is permittedStandard 12 — Profiling: measures against detrimental content, the responsibility for recommendations and the stop rule (ICO Age Appropriate Design Code, statutory guidance under DPA 2018 s 123)

Evidence an auditor expects

• Technical controlTechnical audit

  Profiling restriction implementation

  Code/configuration showing profiling disabled for child users except where strictly necessary

• Policy documentDocument review

  Profiling policy for children

  Policy documenting any profiling of children with necessity justification

Questions people ask

Does CAADCA Section 1798.99.31(b)(2) - No profiling of a child by default (enjoined) apply to my service?

It applies when Service is likely to be accessed by children under 18; and at least one of: Service collects behavioral data; Service uses content personalization; Service uses recommendation algorithms; Service serves targeted advertising. It does not apply where Profiling by default is permitted where the business can demonstrate it has appropriate safeguards in place to protect children AND profiling is necessary to provide the online service, product, or feature requested, and only with respect to the aspects... (Cal. Civ. Code § 1798.99.31(b)(2)(A) and (B)(i)).

From when does this apply?

CAADCA Section 1798.99.31(b)(2) - No profiling of a child by default (enjoined) applies from 1 July 2024. Its current status is: passed, not yet in force.

What evidence does an auditor expect?

Profiling restriction implementation; Profiling policy for children.