Children's Privacy Restriction

What it is

The policy states Oscar's services are not directed to children under 13, that it does not knowingly collect personal information from this age group, and that it endeavors to delete such information if discovered. For individuals aged 13 to 16, the policy states Oscar does not sell or share their information without affirmative authorization, conditioned on Oscar having actual knowledge of the individual's age.

Why it matters (compliance & governance perspective)

The age 13 to 16 protection is conditioned on Oscar having 'actual knowledge' of the individual's age, which is a standard limitation that means the protection may not apply where age is not verified or disclosed; this is a common limitation in online privacy policies that may be evaluated against COPPA and applicable state minor privacy requirements.

Consumer impact (what this means for users)

Under this provision, Oscar does not sell or share data about users aged 13 to 16 without affirmative authorization if it has actual knowledge of their age; however, no age verification mechanism is described in the policy. Users under 13 are prohibited from using the services and the policy states any collected data will be deleted upon discovery.

Institutional analysis (regulatory & governance intelligence)

1) REGULATORY LANDSCAPE: This provision implicates the Children's Online Privacy Protection Act (COPPA), enforced by the FTC, which applies to online services directed to children under 13 or where the operator has actual knowledge of a child user. The age 13 to 16 protections align with CCPA's opt-in requirement for selling or sharing data of minors in that age range. State minor privacy laws in several jurisdictions may impose additional requirements. 2) GOVERNANCE EXPOSURE: Low to Medium. The 'actual knowledge' standard for age 13 to 16 protections is the standard COPPA and CCPA threshold, but the absence of a described age verification or age-gate mechanism means reliance on user disclosure. The FTC has taken enforcement action against companies that failed to implement adequate age verification where the nature of the platform made child users foreseeable. 3) JURISDICTION FLAGS: California's CCPA includes specific opt-in requirements for data sales involving minors aged 13 to 16; the policy's affirmative authorization language aligns with this requirement. The California Age-Appropriate Design Code may impose additional requirements for platforms accessible to minors. States including Illinois and New York have enacted or proposed minor-specific privacy protections. 4) CONTRACT AND VENDOR IMPLICATIONS: Ad technology vendor contracts should include provisions restricting targeted advertising to users where Oscar has not confirmed age, to avoid inadvertent data sales or sharing involving minors. Vendor agreements should confirm that consumer data resellers are prohibited from targeting minor-aged data segments. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should assess whether the platform's user registration and account creation workflows include adequate age disclosure or verification mechanisms consistent with COPPA and CCPA requirements. Processes for identifying and deleting data from users discovered to be under 13 should be documented and tested. The affirmative authorization mechanism for age 13 to 16 users should be operationally defined and documented.

Applicable agencies

Provision details

Other risks in this policy

• Use of PI for marketing and advertising medium
• Account permanently terminated upon deletion request high
• Acknowledgment of notice terms by use high
• California PI sold or shared with third parties high
• Collection of direct personal identifiers high
• Disclosure to third party ad networks high