Yes. Controllers generally must obtain consent before processing a consumer’s sensitive data. Processing sensitive data about known children must comply with applicable COPPA requirements.
The law also requires consent before targeted advertising or selling personal data when the controller actually knows the consumer is at least 13 but younger than 16.
Consent must be affirmative, freely given, specific, informed, and unambiguous. Agreement obtained through dark patterns, certain passive interactions, or acceptance of broad terms containing unrelated processing descriptions does not qualify. Controllers must provide an effective withdrawal mechanism that is at least as easy as the method used to give consent.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
These FAQs provide general information and operational commentary. They are not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is intended as a starting point for understanding the issues discussed and should not be relied on as a substitute for advice from qualified legal counsel.
These materials were obtained directly from the Federal Government public website and are posted here for your review and reference only. No Claim to Original U.S. Government Works. This may not be the most recent version. The U.S. Government may have more current information. We make no guarantees or warranties about the accuracy or completeness of this information, or the information linked to. Please check the linked sources directly.