PI of consumers under 16 not sold without opt-in consent

CCPA § 1798.120(c) and (d) impose heightened protections for minors: consumers aged 13–15 must affirmatively opt in before their PI is sold or shared (reversing the adult default of opt-out); those under 13 require parental opt-in. An application with social features, gaming mechanics, or educational content that applies the adult opt-out default to all users — because it has no age gate — is violating these provisions for every minor user. Unlike adult violations where the consumer must take action to trigger an investigation, minor PI violations can be initiated by the California AG or CPPA without a consumer complaint.

Implement an age gate at signup or add age-differentiated consent logic in the data-sharing flow. The simplest compliant path for most applications is an 18+ gate that eliminates the need for age-differentiated consent entirely.

// Simplest path: 18+ age gate at signup
<form onSubmit={handleSignup}>
  <label>
    <input type="checkbox" required name="ageConfirm" />
    I confirm I am 18 years of age or older
  </label>
  <button type="submit">Create Account</button>
</form>

// If you must allow under-16 users, require opt-in for data sharing:
function DataSharingConsent({ userAge }: { userAge: number | null }) {
  if (userAge !== null && userAge < 16) {
    return (
      <label>
        <input type="checkbox" name="shareConsent" />
        I consent to sharing my information for personalized advertising
        {/* Must be affirmative opt-in, not pre-checked */}
      </label>
    )
  }
  return <a href="/do-not-sell">Opt out of data sharing</a>
}

Document the age gate approach in your privacy policy: "Our service is restricted to users 18 years of age or older." If the 18+ gate is your approach, CCPA § 1798.120(c) minor consent requirements do not apply.