EvidenceSheet
CCPA/CPRA · Verification, agents, minors and non-discrimination

1798.120(c) Obtain opt-in before selling or sharing data of consumers under 16

A business may not sell or share data about a consumer it knows (or wilfully ignores) is under 16 unless the consumer, if 13 to 15, or a parent or guardian, if under 13, has affirmatively authorised it. Under 11 CCR 7070 and 7071 the business must document a reasonable parental-consent method for under-13s and an opt-in process for 13 to 15 year olds, tell them of the continuing right to opt out, and describe these processes in its privacy policy (7072).

Source: CCPA/CPRA, 1798.120(c). The statement above is our statement of the clause, read from the published text and cited so you can check it against the official text, not the instrument verbatim. Open CCPA/CPRA in the compliance library.

Applies only to a business that meets one of the thresholds in Cal. Civ. Code 1798.140(d).

4
artefacts
0
held by a system
2
at each review
hard
to go live
Document repository
where the evidence lives
teal = a system already holds it · olive = produced at each review. To go live: easy when half or more of the artefacts are already held by a system, moderate from a quarter to a half, hard below a quarter.

These are the artefacts auditors commonly ask for on this requirement, our guidance rather than text from the standard. Your assessor decides what is sufficient in your context, and asks for samples across the period when a report covers one.

system holds itEvidence a system already holds

none for this control

periodic reviewEvidence produced at each review

  • Parental consent mechanism records for under-13 users · Data governance / DLP tooling
  • Opt-in records for users aged 13 to 15 · Document repository

governing documentDocuments that govern the control

  • Age-determination approach and the signals treated as actual knowledge of age · Document repository
  • Privacy policy section describing the processes · Policy repository / GRC workspace

First move

No system holds this evidence for you: it is people and documents. Reminders and routing to the owner still save time. Put the document under version control with an owner and review date, and log each review as a record with reviewer and date.

Common gaps auditors find

Do this for your whole sheet

Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.

Build my evidence sheet

1798.120 Honour the right to opt out of sale or sharing · 1798.121 Honour the right to limit use of sensitive personal information