US privacy child consent clarifications #84

lamrowena · 2023-06-29T02:33:42Z

Added clarifications to the descriptions of the values for KnownChildSensitiveDataConsents fields in the usnat, usca, usco, usct, and usut sections.
Included hyperlinks for all US sections in Section Information

- US National child consent clarifications

Added hyperlinks to US sections listed

Sections/US-National/IAB Privacy’s National Privacy Technical Specification.md

patmmccann · 2023-06-29T15:57:42Z

Sections/US-National/IAB Privacy’s National Privacy Technical Specification.md

+      <li>Cal. Civ. Code Cal. Civ. Code 1798.120(c)</li>
+      <li>Conn. PA 22-15, Sec. 6(a)(4)</li>
+    </ul>
+  <p></p>(2) Verifiable consent obtained from the Consumer’s parent or lawful guardian to Process the Personal Data or Sensitive Data of a Consumer Younger Than 13 Years of Age.


why is younger capitalized?

This was there from the original requirements document.

patmmccann · 2023-06-29T16:01:47Z

...ions/US-States/CA/GPP Extension: IAB Privacy’s California Privacy Technical Specification.md

@@ -98,7 +98,7 @@
 <tr>
 <td style="text-align:left">KnownChildSensitiveDataConsents</td>
 <td style="text-align:left">N-Bitfield(2,2)</td>
-<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Business does not have actual knowledge that it Processes Personal Information of Consumers Less Than 16 years of Age.<p><code>1</code> No Consent<p><code>2</code> Consent<p>Data Activities:<p>(1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age<p>(2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age</td>
+<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Business does not have actual knowledge that this transaction involves Processing the Personal Information of a Consumer who is Less Than 16 years of Age.<p><code>1</code> No Consent<p><code>2</code> Consent<p>Data Activities:<p>(1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent or guardian. For a Consumer the Business has actual knowledge is  between the ages of 13 and 16, this must be Consumer consent.<p>(2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent of guardian. For a Consumer the Business has actual knowledge is between the ages of 13 and 16, this must be Consumer consent.</td>


It is unclear which bit is for 0-12 and which is for 13-15 (or is it 13-16?), as both groups are discussed in both parts

The first bit is for the sell of personal information and the second bit is the for the share of personal information. For each bit, if the consumer is under 13, the consent must be given by the parent or guardian. And if the consumer is between 13 and 16, consent must be given but by the consumer.

this still reads as broken to me

13-16 is not a subset of "Less Than 16 years"

patmmccann

i find these changes difficult to decipher

patmmccann · 2023-07-12T15:53:18Z

...ions/US-States/CA/GPP Extension: IAB Privacy’s California Privacy Technical Specification.md

@@ -98,7 +98,7 @@
 <tr>
 <td style="text-align:left">KnownChildSensitiveDataConsents</td>
 <td style="text-align:left">N-Bitfield(2,2)</td>
-<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Business does not have actual knowledge that it Processes Personal Information of Consumers Less Than 16 years of Age.<p><code>1</code> No Consent<p><code>2</code> Consent<p>Data Activities:<p>(1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age<p>(2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age</td>
+<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Business does not have actual knowledge that this transaction involves Processing the Personal Information of a Consumer who is Less Than 16 years of Age.<p><code>1</code> No Consent<p><code>2</code> Consent<p>Data Activities:<p>(1) Consent to Sell the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent or guardian. For a Consumer the Business has actual knowledge is  between the ages of 13 and 16, this must be Consumer consent.<p>(2) Consent to Share the Personal Information of Consumers Less Than 16 years of Age. For a Consumer the Business has actual knowledge is under 13 years of age, this must be consent given by the Consumer’s parent of guardian. For a Consumer the Business has actual knowledge is between the ages of 13 and 16, this must be Consumer consent.</td>


this still reads as broken to me

patmmccann · 2023-07-12T15:57:00Z

...ons/US-States/CT/GPP Extension: IAB Privacy’s Connecticut Privacy Technical Specification.md

@@ -95,7 +95,7 @@
 <tr>
 <td style="text-align:left">KnownChildSensitiveDataConsents</td>
 <td style="text-align:left">N-Bitfield(2,3)</td>
-<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Controller does not Process Sensitive Data of a known Child.<p><code>1</code> No Consent<p><code>2</code> Consent<p>(1) Consent to Process Sensitive Data from a Known Child.<p>(2) Consent to Sell the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age.<p>(3) Consent to Process the Personal Data of Consumers At Least 13 Years of Age but Younger Than 16 Years of Age for Purposes of Targeted Advertising.</td>
+<td style="text-align:left">Two bits for each Data Activity:<p><code>0</code> Not Applicable. The Controller does not Process Sensitive Data of a Consumer the Business has actual knowledge is less than 16 years old.<p><code>1</code> No Consent<p><code>2</code> Consent<p>(1) Verifiable parental consent to Process Sensitive Data from a Consumer the Business has actual knowledge is less than 13 years old.<p>(2) Consumer Consent to Sell the Consumer’s Personal Data for a Consumer at Least 13 Years of Age but Younger Than 16 Years of Age.<p>(3) Consumer Consent to Process the Consumer’s Personal Data for Purposes of Targeted Advertising for a Consumer At Least 13 Years of Age but Younger Than 16 Years of Age.</td>


this is also reading as broken to me, for example, writing 0 in the first bit field might suggest the business doesnt process data for a 14 year old even though the field is exclusive to 0-12 year olds

…ification.md Updated section information with "of the spec" approved language by Global Privacy working group.

…ication.md Updated section information with "of the spec" approved language by Global Privacy working group.

…cification.md Updated section information with "of the spec" approved language by Global Privacy working group.

…ion.md Updated section information with "of the spec" approved language by Global Privacy working group.

lamrowena added 6 commits June 26, 2023 15:58

Update IAB Privacy’s National Privacy Technical Specification.md

3c74f10

- US National child consent clarifications

Clarifications to KnownChildConsents CA

17fb659

Clarifications to KnownChildConsents CO

f951e3a

Clarifications to KnownChildConsents CT

dc17753

Clarifications to KnownChildConsents UT

15ea30f

US state section hyperlinks

61a2918

Added hyperlinks to US sections listed

patmmccann reviewed Jun 29, 2023

View reviewed changes

Sections/US-National/IAB Privacy’s National Privacy Technical Specification.md Outdated Show resolved Hide resolved

patmmccann reviewed Jun 29, 2023

View reviewed changes

Updated to under 17

2fb2639

patmmccann suggested changes Jul 12, 2023

View reviewed changes

jaredmoscow added 4 commits June 24, 2024 10:51

Update GPP Extension: IAB Privacy’s California Privacy Technical Spec…

11cdb8e

…ification.md Updated section information with "of the spec" approved language by Global Privacy working group.

Update GPP Extension: IAB Privacy’s Colorado Privacy Technical Specif…

6321c0f

…ication.md Updated section information with "of the spec" approved language by Global Privacy working group.

Update GPP Extension: IAB Privacy’s Connecticut Privacy Technical Spe…

a88d06b

…cification.md Updated section information with "of the spec" approved language by Global Privacy working group.

Update GPP Extension: IAB Privacy’s Utah Privacy Technical Specificat…

a21cfba

…ion.md Updated section information with "of the spec" approved language by Global Privacy working group.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

US privacy child consent clarifications #84

US privacy child consent clarifications #84

lamrowena commented Jun 29, 2023

patmmccann Jun 29, 2023

lamrowena Jul 3, 2023

patmmccann Jun 29, 2023

lamrowena Jul 3, 2023

patmmccann Jul 12, 2023

patmmccann Jul 12, 2023

patmmccann left a comment

patmmccann Jul 12, 2023

patmmccann Jul 12, 2023

US privacy child consent clarifications #84

Are you sure you want to change the base?

US privacy child consent clarifications #84

Conversation

lamrowena commented Jun 29, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

patmmccann left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment