So that's a category that takes on certainly more significance when the consumer might be a minor, right?

That's right.

The amended regulations expanded the definition of sensitive personal information to include personal information of consumers.

A business has actual knowledge are under 16, regardless of what category that information otherwise falls into.

That has real consequences.

Businesses have to honor... request to limit its use, built it into risk assessments the same way they would otherwise sensitive categories like health or geolocation data, and apply the same heightened scrutiny.

Businesses with services used by children or teenagers should examine age assurance practices, advertising, default settings, retention, and product design.

So if we think about some of the substantive points, what are the practical takeaways? What should a general counsel, a chief privacy officer, or a chief information security officer do in the next 90 days?