4 Colo. Code Regs. § 904-3-7.06

Current through Register Vol. 47, No. 16, August 25, 2024

Section 4 CCR 904-3-7.06 - CONSENT FOR CHILDREN

A. When a Controller engages in Processing activities involving the collection and Processing of Personal Data from a known Child or operates a website or business directed to Children or has actual knowledge that it is collecting or maintaining Personal Data from a Child, the Controller must obtain Consent from the parent or lawful guardian of that Child before collecting or Processing the Child's Personal Data.

B. A Controller Processing the Personal Data of a Child must make reasonable efforts to obtain verifiable parental Consent, taking into consideration available technology. Any method to obtain verifiable parental Consent must be reasonably calculated, in light of available technology, to ensure that the person providing Consent is the Child's parent or lawful guardian.

C. Reasonably calculated methods for determining that a person Consenting to the Processing of a Child's Personal Data is the parent or lawful guardian of that Child include, but are not limited to:

1. Providing a Consent form to be signed by the parent or guardian under penalty of perjury and returned to the business by postal mail, facsimile, or electronic scan;

2. Requiring a parent or guardian, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder;

3. Having a parent or guardian call a toll-free telephone number staffed by trained personnel;

4. Having a parent or guardian connect to trained personnel via videoconference; and

5. Verifying a parent or guardian's identity by checking a form of government-issued identification against databases of such information, as long as the parent or guardian's identification is deleted by the business from its records promptly after such verification is complete.

D. Any Personal Data collected for purposes of verifying the identity of a parent or legal guardian may not be used for any reason other than Processing these verifications.

4 CCR 904-3-7.06

46 CR 06, March 25, 2023, effective 7/1/2023