SB24-041: Data Protections for Minors' Online Activity

• Requires controllers offering online services to minors (under 18) to use reasonable care to avoid heightened risk of harm, with a rebuttable presumption of compliance if the controller follows the law

• Prohibits processing minors' personal data for targeted advertising, sale of personal data, or profiling without obtaining the minor's consent (or parental consent for children under 13)

• Bans collecting precise geolocation data from minors unless necessary for the service, collected only for required duration, and with a visible signal to the minor (except for ski area applications)

• Prohibits system design features that significantly increase, sustain, or extend minors' use of online services and requires safeguards on direct messaging to limit unsolicited adult contact

• Requires controllers to conduct data protection assessments for online services posing heightened risks of harm to minors, with assessments confidential but available to the Attorney General for enforcement purposes; takes effect October 1, 2025