BILL ANALYSIS                                                                                                                                                                                                    






                             SENATE JUDICIARY COMMITTEE
                             Senator Noreen Evans, Chair
                              2013-2014 Regular Session


          SB 568 (Steinberg)
          As Amended April 1, 2013
          Hearing Date: April 23, 2013
          Fiscal: No
          Urgency: No
          BCP
                    

                                        SUBJECT
                                           
                              Privacy: Internet: Minors

                                      DESCRIPTION  

          This bill would prohibit an operator of an Internet Web site,  
          online service, online application, or mobile application, as  
          specified, from marketing or advertising a product or service to  
          a minor, as defined, if the minor cannot legally purchase the  
          product or participate in the service in the State of  
          California. This bill would also prohibit an operator from  
          using, disclosing, or compiling, or allowing a third party to  
          knowingly use, disclose, or compile, the personal information of  
          a minor for the purpose of marketing goods or services that  
          minors cannot legally purchase in the State of California.

          The bill would, on and after January 1, 2015, require the  
          operator of an Internet Web site, online service, online  
          application, or mobile application to permit a minor to remove  
          content or information submitted to or posted on the operator's  
          Internet Web site, service, or application by the minor, as  
          specified.  This bill would also require the operator to provide  
          notice to a minor that the minor may remove the content or  
          information, as specified.

                                      BACKGROUND  

          Enacted in 1998, the federal Child's Online Privacy Protection  
          Act of 1998 (COPPA), requires the Federal Trade Commission (FTC)  
          to issue and enforce a rule (the Rule) concerning children's  
          online privacy.  The FTC further notes that:

                                                                (more)



          SB 568 (Steinberg)
          Page 2 of ?



            The primary goal of COPPA and the Rule is to place parents  
            in control over what information is collected from their  
            young children online. The Rule was designed to protect  
            children under age 13 while accounting for the dynamic  
            nature of the Internet. The Rule applies to operators of  
            commercial websites and online services directed to children  
            under 13 that collect, use, or disclose personal information  
            from children, and operators of general audience websites or  
            online services with actual knowledge that they are  
            collecting, using, or disclosing personal information from  
            children under 13. (Federal Trade Commission: Frequently  
            Asked Questions about the Children's Online Privacy  
            Protection Rule   
            [as of Apr. 19, 2013].)

          On December 19, 2012, the FTC announced final amendments to  
          the COPPA rule in order to strengthen privacy protections for  
          children and to give parents greater control over personal  
          information that online services may collect from children.   
          The New York Times' December 19, 2012 article entitled "New  
          Online Privacy Rules for Children" reported:

            In an era of widespread photo sharing, video chatting and  
            location-based apps, the revised children's privacy rule  
            makes clear that companies must obtain parental consent  
            before collecting certain details that could be used to  
            identify, contact or locate a child. These include photos,  
            video and audio as well as the location of a child's mobile  
            device.

            While the new rule strengthens such safeguards, it could  
            also disrupt online advertising. Web sites and online  
            advertising networks often use persistent identification  
            systems - like a cookie in a person's browser, the unique  
            serial number on a mobile phone, or the I.P. address of a  
            computer - to collect information about a user's online  
            activities and tailor ads for that person.

            The new rule expands the definition of personal information  
            to include persistent IDs if they are used to show a child  
            behavior-based ads. It also requires third parties like ad  
            networks and social networks that know they are operating on  
            children's sites to notify and obtain consent from parents  
            before collecting such personal information. And it makes  
            children's sites responsible for notifying parents about  
            data collection by third parties integrated into their  
                                                                      



          SB 568 (Steinberg)
          Page 3 of ?



            services. (Singer, New Online Privacy Rules for Children,  
            The New York Times (Dec. 19, 2012)  
             [as of Apr. 19,  
            2013].)

          In order to further protect minors online, this bill would  
          prohibit the operator of an Internet Web site or other online  
          service from marketing or advertising a product or service to  
          a minor if the minor cannot legally purchase the product or  
          participate in the service in California, or, compiling  
          personal information to market those products or services.   
          That prohibition would apply to operators that have actual  
          knowledge that a minor is using its online service or whose  
          site service is directed to minor. This bill would also, as of  
          January 1, 2015, permit a minor to remove content or  
          information posted to a Web site or service, as specified.



                                CHANGES TO EXISTING LAW
           
           Existing law  provides that, among other rights, all people have  
          an inalienable right to pursue and obtain privacy.  (Cal.  
          Const., art. I, Sec. 1.)
           
           Existing case law  permits a person to bring an action in tort  
          for an invasion of privacy and provides that in order to state a  
          claim for violation of the constitutional right to privacy, a  
          plaintiff must establish the following three elements: (1) a  
          legally protected privacy interest; (2) a reasonable expectation  
          of privacy in the circumstances; and (3) conduct by the  
          defendant that constitutes a serious invasion of privacy.  (Hill  
          v. National Collegiate Athletic Assn. (1994) 7 Cal.4th 1.)   
          Existing law recognizes four types of activities considered to  
          be an invasion of privacy, giving rise to civil liability  
          including the public disclosure of private facts.  (Id.)
           
           Existing case law  provides that there is no reasonable  
          expectation of privacy in information posted on an Internet Web  
          site.  The information is no longer a "private fact" that can be  
          protected from public disclosure.  (Moreno v. Hanford Sentinel  
          (2009) 172 Cal.App.4th 1125.)

          Existing federal law  requires an operator of an Internet Web  
          site or online service directed to a child, as defined, or an  
                                                                      



          SB 568 (Steinberg)
          Page 4 of ?



          operator of an Internet Web site or online service that has  
          actual knowledge that it is collecting personal information from  
          a child to provide notice of what information is being collected  
          and how that information is being used, and to give the parents  
          of the child the opportunity to refuse to permit the operator's  
          further collection of information from the child. (15 U.S.C.  
          Sec. 6502.)
          
           This bill  would prohibit an operator of an Internet Web site,  
          online service, online application, or mobile application  
          directed to minors or the operator of an Internet Web site,  
          online service, online application or mobile application that  
          has actual knowledge that a minor is using its Internet Web  
          site, online service, online application, or mobile application  
          from:
                 marketing or advertising a product or service to a  
               minor, if the minor cannot legally purchase the product or  
               participate in the service in the State of California; or
           using, disclosing, or compiling, or knowingly allowing a third  
            party to use, disclose, or compile, the personal information  
            of a minor for the purpose of marketing goods or services that  
            minors cannot legally purchase or engage in in the State of  
            California.

           This bill  , as of January 1, 2015, would require an operator of  
          an Internet Web site, online service, online application, or  
          mobile application to do all of the following:
                 permit a minor who is a user of the operator's Internet  
               Web site, service, or application to remove content or  
               information submitted to or posted on the operator's Web  
               site, service or application by the user; and
           provide notice to a minor who is the user of the operator's  
            Internet Web site, service, or application that the minor may  
            remove content or information submitted to or posted on the  
            operator's Web site, service, or application by the user; and
           provide notice to a minor who is the user of the operator's  
            Internet Web site, service, or application that the removal  
            described above does not ensure complete or comprehensive  
            removal of the content or information.

           This bill  , as of January 1, 2015, would provide that an operator  
          or third party is not required to erase or otherwise eliminate  
          content or information in either of the following circumstances:
                 any other provision of federal or state law requires the  
               operator or third party to maintain the content or  
               information; or
                                                                      



          SB 568 (Steinberg)
          Page 5 of ?



                 the content or information was submitted to the  
               operator's Internet Web site, service, or application by a  
               third party other than the minor user, including any  
               content or information submitted by the minor user that was  
               republished or resubmitted by the third party.

           This bill  would provide that the above provisions shall not be  
          construed to limit the authority of a law enforcement agency to  
          obtain any content or information from an operator as authorized  
          by law or pursuant to an order of a court of competent  
          jurisdiction. 

           This bill  would also define minor as a natural person under 18  
          years of age.

                                        COMMENT
           
          1.   Stated need for the bill  

          According to the author:

            A large part of a child's social and emotional development  
            is occurring while that child navigates through the digital  
            world while online and through their cell phone.  Children  
            ages 8 to 18 spend an average of an hour and a half each day  
            using a computer for purposes other than school work.   
            Seventy-five percent of teenagers now own cell phones, and  
            25 [percent] use those phones for social media.   

            Federal Law, known as the Children's Online Privacy  
            Protection Act (COPPA)[,] has protections in place to  
            protect children under the age of thirteen.  There is a need  
            to protect these children, consistent with COPPA, and extend  
            protections in the digital world to teens.  The percent of  
            teens that use social network sites almost doubles between  
            ages 12 and 13.  In fact, over 80 [percent] of 13 year old  
            users actively use social media.

            Young children and teens are still developing their critical  
            thinking skills and judgment.  As children are coming of age  
            in the digital world, we see that they have a tendency to  
            reveal before they reflect. When polled, 92 [percent] of  
            teens said they should be allowed to erase personal  
            information that they post.    
            . . .
            SB 568 protects California's children in the digital world.   
                                                                      



          SB 568 (Steinberg)
          Page 6 of ?



            The bill prohibits digital sites directed to minors from  
            advertising or marketing services or products that minors  
            cannot engage in or legally purchase under California law.   
            It also prohibits digital sites from advertising or  
            marketing these illegal products or services to a user they  
            know to be a minor.   The bill stops the practice of  
            collecting minors' personal information for the purpose of  
            advertising or marketing services or products that are  
            illegal for the child to engage in or purchase.  SB 568 also  
            ensures that minors are given the option to erase anything  
            they have personally posted.

          2.   Prohibitions related to services or products that a minor  
          cannot legally purchase 
           
          This bill would enact two prohibitions related to the marketing  
          or advertising of goods or services that a minor cannot legally  
          purchase or participate in in the State of California.  Both of  
          those prohibitions would apply only where the Internet Web site,  
          online service, online application or mobile application is  
          "directed" to minors, or, where the operator has actual  
          knowledge that a minor is using its Internet Web site, online  
          service, online application, or mobile application.

            a.   Prohibition on marketing or advertising  

            First, the bill would expressly prohibit the marketing or  
            advertising of a product or service to a minor, if the minor  
            cannot legally purchase the product or participate in the  
            service in the State of California.  That prohibition  
            technically restricts the commercial speech of the operator of  
            the Web site or other online service by prohibiting the  
            operator from delivering the message (even though the  
            underlying product cannot lawfully be purchased), but, the  
            mere fact that it restricts speech does not mean that such a  
            restriction would violate the First Amendment of the United  
            States Constitution or Article I of the California  
            Constitution.

            Generally speaking, the First Amendment, and Article I of the  
            California Constitution, act to protect the freedom of  
            expression of the citizens of California.  Commercial speech,  
            which is done on behalf of a company or individual for purpose  
            of making a profit, has not been afforded full protection  
            under the First Amendment by the United States Supreme Court.   
            In order to be upheld as a valid restriction on commercial  
                                                                      



          SB 568 (Steinberg)
          Page 7 of ?



            speech, the proposed law must meet the following four-part  
            test: (1) the speech must be about a lawful activity and  
            cannot be false or misleading; (2) the government must have a  
            substantial interest; (3) the law must directly advance the  
            governmental interest asserted; and (4) the law must be no  
            more extensive than necessary. (Central Hudson Gas v. Public  
            Service Commission (1980) 447 U.S. 559.)
            In this case, the proposed restriction would appear to be a  
            valid restriction on commercial speech since, as a threshold  
            matter, one may argue that it is not lawful to advertise  
            products to a minor that the minor cannot purchase.  Even if  
            the speech is lawful, the State of California arguably has a  
            strong interest in taking steps to prevent illegal products  
            from being sold to minors, and, the proposed law would advance  
            that interest in a manner that does not cover products which  
            are legal for minors to purchase in California.  Although a  
            determination regarding the First Amendment is ultimately for  
            the courts, it would appear that the proposed restriction on  
            marketing and advertising could survive such a challenge.

            Staff also notes that, as a matter of public policy, it is  
            important that minors (who may be impressionable) are not  
            targeted by advertisers seeking to sell products or services  
            that the minor cannot legally purchase.  Those advertisements  
            arguably only serve the purpose of encouraging a minor to  
            purchase a product or service that has already been determined  
            to be inappropriate for a person of that age.  

            b.   Prohibition on using, disclosing, compiling personal  
            information for purpose of marketing illegal goods or services  

            Similar to the above provision, this bill would further  
            prohibit an operator from using, disclosing, compiling, or  
            knowingly allowing a third party to use, disclose, or compile  
            the personal information of a minor for purpose of marketing  
            good or services that the minor cannot legally purchase.  That  
            prohibition on using the personal information for purposes of  
            marketing would essentially prevent operators from using  
            unique details about a minor to market illegal goods or  
            services to that specific minor.  Staff notes that, as with  
            the other provision, this restriction would only apply where  
            the operator had actual knowledge that a user was a minor, or,  
            directed the Web site or service to minors.

            Regarding the importance of protecting minors from marketing  
            of illegal goods or services, the author further asserts:  
                                                                      



          SB 568 (Steinberg)
          Page 8 of ?



            "Because of their still developing capacity for  
            self-regulation, still developing critical thinking skills,  
            still developing their ability to use sound judgment, and  
            susceptibility to peer pressure, children and adolescents are  
            at greater risk than adults as they navigate through the  
            digital world and experiment with social media.  Children are  
            more susceptible to online marketing of harmful products and  
            it is our responsibility to ensure that children are not  
            bombarded with inappropriate advertisements while they are  
            navigating sites directed towards children or served  
            advertisements for products they can't legally purchase when  
            an operator has actual knowledge that they are under the age  
            of 18.  It is our responsibility as a state to ensure that  
            operators of sites directed towards children do not put our  
            children's safety in jeopardy."




          3.    Ability to remove content or information  

          As of January 1, 2015, this bill would require an operator of an  
          Internet Web site, online service, online application, or mobile  
          application to: (1) permit a minor to remove content or  
          information submitted or posited on the website, service, or  
          application; and (2) provide notice to a minor of his or her  
          ability to remove content and a notes that removal does not  
          ensure complete or comprehensive removal of content or  
          information.

            a.   Removal of information and notice of that ability  

            In support of the need to allow minors to remove information  
            submitted or posted on a Web site, service, or application,  
            the author notes: "Children should be allowed to erase that  
            which they post because mistakes can follow a young person for  
            a long time and impact their chances of getting into college  
            and landing a job.  In fact, a 2011 Kaplan Survey found that  
            27 [percent] of college admissions officers check Google and  
            26 [percent] check Facebook as part of the applicant review  
            process. . . .  Over a third of employers, according to a  
            CareerBuilder study, say that they will not hire someone whose  
            Facebook page includes photos of that person drinking or in  
            provocative dress."  Staff further notes that this bill  
            appears to avoid complicated authentication issues by simply  
            providing that if a user is a minor, and, that user posts  
                                                                      



          SB 568 (Steinberg)
          Page 9 of ?



            content or information - that same user has the ability to  
            remove that content or information.  The ability appears to  
            already exist for users on sites such as Facebook, but, this  
            bill would both ensure the continued ability to delete  
            information that a minor realizes could be harmful to his or  
            her future endeavors.

            Staff notes that the proposed disclosure would also inform  
            minors that removal does not ensure a comprehensive removal of  
            information, which, as a practical matter, is important  
            because even if the posted content is removed from a site  
            (such as Facebook), that same information may have been cached  
            by another Internet Web site, copied to another page, or  
            spread throughout the Internet by other means.  As a result,  
            the language of this bill accurately recognizes the  
            limitations posed by the Internet, as well as balancing the  
            speech rights of all parties involved.

             b.   Limitations  

            This bill would additionally provide that an operator or a  
            third party is not required to erase or otherwise eliminate  
            content or information in either of the following  
            circumstances:  (1) any other provision of federal or state  
            law requires the operator or third party to maintain the  
            information; or (2) the content was submitted by a third  
            party.  Those limitations ensure compliance with other laws  
            and protect the speech rights of third parties who may use a  
            statement by a minor in the context of their own speech (for  
            example, a user on Twitter who "retweets" a minor's "tweet"  
            with their own commentary).

            Similarly, this bill would state that the ability for a minor  
            to remove information shall not be construed to limit the  
            authority of a law enforcement agency to obtain any content or  
            information from an operator as authorized by law or pursuant  
            to an order of a court of competent jurisdiction.  That  
            exception is arguably important given the role that social  
            networking sites have played in various recent news events -  
            the information posted by a minor could be of pivotal  
            importance in the investigation of a crime.


           Support  :  Child Abuse Prevention Center; Children Now; Common  
          Sense Media; Crime Victims United of California

                                                                      



          SB 568 (Steinberg)
          Page 10 of ?



           Opposition  :  None Known

                                        HISTORY
           
           Source  :  Author

           Related Pending Legislation  :

          SB 501 (Corbett) would require social networking Web sites to  
          remove the personal information of a registered user, upon  
          request, and permit a parent or legal guardian of a registered  
          user who identifies himself or herself as under 18 years of age  
          to request the social networking internet Web sites to remove  
          personal identifying information of their children.  This bill  
          is set for hearing on April 23, 2013 in the Senate Judiciary  
          Committee.

          AB 1291 (Lowenthal) would create the Right to Know Act of 2013,  
          repealing and reorganizing certain provisions of existing law  
          pertaining to the disclosure of a consumer's personal  
          information.  This bill is in the Assembly Judiciary Committee.

           Prior Legislation  :

          SB 632 (Davis, 2009) would have required a social networking  
          Internet Web site to provide a disclosure to users that an image  
          which is uploaded onto the Web site is capable of being copied,  
                                                without consent, by persons who view the image, or copied in  
          violation of the privacy policy, terms of use, or other policy  
          of the site.  This bill was vetoed.
           
          SB 1361 (Corbett, 2010) would have prohibited a social  
          networking Internet Web site, as defined, from displaying, to  
          the public or other registered users, the home address or  
          telephone number of a registered user of that Internet Web site  
          who is under 18 years of age, as provided.  This bill failed  
          passage in the Assembly Arts, Entertainment, Sports, Tourism,  
          and Internet Media Committee.
           
          SB 242 (Corbett, 2011) would have prohibited a social networking  
          Internet Web site from displaying the home address or telephone  
          number, in specified text fields, of a registered user who  
          identifies himself or herself as under 18 years of age.  This  
          bill failed passage on the Senate Floor.
           
          SB 761 (Lowenthal, 2012) would have required the Attorney  
                                                                      



          SB 568 (Steinberg)
          Page 11 of ?



          General, by July 1, 2012, to adopt regulations that would  
          require online businesses to provide California consumers with a  
          method for the consumer to opt out of the collection or use of  
          his or her information by the business.  This bill died in the  
          Senate Appropriations Committee.

                                   **************