Various Privacy Laws may Apply
If you live in the EU, the site may be required to delete this information under the GDPR. If you live in the UK, you may have the right to deletion under the UK-GDPR. In each case the procedure for enforcing such a right if the business does not respond depends on the law of your country, and would involve a suit in the courts of that country. Even if a judgement including a court order is obtained, enforcing this on a US firm may not be easy.
If you live in California, you may have a right to the deletion of the info under the California Consumer Privacy Act (CCPA) (soon to be replaced by a modified version, the California Privacy Rights Act (CPRA)). If you live in Virginia, you may have rights under the Virginia Consumer Data Protection Act (VCDPA). All these right are subject to various exceptions.
Several other states, including Colorado, have passed similar laws, but they have not yet gone into effect.
See also "Consumers’ “Right to Delete” under US State Privacy Laws" published by Consumer Privacy World and written by By Glenn A. Brown on March 3, 2021.
Since the information was collected (posted) when you were less than 12, your parents may have the right to request deletion under the Federal Children's Online privacy Protection Act (COPPA)
The DMCA deals with alleged copyright violations, not with personal privacy issues.
CCPA / CPRA
The CCPA right to delete applies only to information supplied by the Data Subject (DS). The CCPA right to delete is given by California Civil Code section 1798.105 The Buisness has 10 days to acknowledge a request, and 45 days to respond, which may be extended for an additional 45 days.
Note also that the CCPA requires various notices to be delivered to the consumer, and normally requires a privacy policy to be posted. This must include notification of the consumer's rights.
Under the CCPA a consumer may not sue a firm directly to enforce the right to delete. Instead a complaint may be made to the California Attorney General, who is empowered to take enforcement action. Only in cases of a data breach ca a consumer sue a firm directly.
Note that he CCPA appliws only to firms that:
- are for-profit businesses that do business in California and
- Have a gross annual revenue of over $25 million; or
- Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or
- Derive 50% or more of their annual revenue from selling California residents’ personal information.
See also the official page "California Consumer Privacy Act (CCPA)"
VCDPA
Section 59.1-573 (A) provides that
(A) A consumer may invoke the consumer rights authorized pursuant to this subsection at any time by submitting a request to a controller specifying the consumer rights the consumer wishes to invoke. A known child's parent or legal guardian may invoke such consumer rights on behalf of the child regarding processing personal data belonging to the known child. A controller shall comply with an authenticated consumer request to exercise the right:
...
(A) 3. To delete personal data provided by or obtained about the consumer;
(A) 4. To obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and
(A) 5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.
Under subsection B the controller (firm) has 45 days to respond, which may be extended for up to an additional 45 days
Under 59.1-574 (A) a controller has verious obligations including to:
Limit the collection of personal data to what is adequate, relevant, and reasonably necessary ...
and to:
Not process sensitive data concerning a consumer without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a known child, without processing such data in accordance with the federal Children's Online Privacy Protection Act (15 U.S.C. з 6501 et seq.).
Under subsectiuon (B) the rights may not be waived by contract. Under subsection (c) the controller must provide:
a reasonably accessible, clear, and meaningful privacy notice
and this notice must contain:
one or more secure and reliable means for consumers to submit a request to exercise their consumer rights under this chapter. Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests, and the ability of the controller to authenticate the identity of the consumer making the request. Controllers shall not require a consumer to create a new account in order to exercise consumer rights pursuant to з 59.1-573 but may require a consumer to use an existing account.
various exemptions are provided for in the VCDPA. As with the CCPA, the previsions may only be enforced by the state Attorney General, not by private lawsuit.
The VCDPA only applies to:
persons that conduct business in the Commonwealth or produce products or services that are targeted to residents of the Commonwealth and that (i) during a calendar year, control or process personal data of at least 100,000 consumers or (ii) control or process personal data of at least 25,000 consumers and derive over 50 percent of gross revenue from the sale of personal data.
In many ways it is quite similar to the CCPA.
COPPA
COPPA is a federal law that applies to services, including websites, that collect personal information about children under age 13. It imposes various responsibilities and restrictions on such providers, and give the parents of such children various rights.
According to the FTC pagw "Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business""
Even if parents have agreed that you may collect information from their kids, parents have ongoing rights — and you have continuing obligations.
If a parent asks, you must:
- give them a way to review the personal information collected from their child;
- give them a way to revoke their consent and refuse the further use or collection of personal information from their child; and
- delete their child’s personal information.
The FTC's FAQ on COPPA states:
The primary goal of COPPA is to place parents in control over what information is collected from their young children online. The Rule was designed to protect children under age 13, while accounting for the dynamic nature of the Internet. The Rule applies to operators of commercial websites and online services (including mobile apps and IoT devices, such as smart toys) directed to children under 13 that collect, use, or disclose personal information from children, or on whose behalf such information is collected or maintained (such as when personal information is collected by an ad network to serve targeted advertising). The Rule also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13, and to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children. Operators covered by the Rule must:
...
- Provide parents access to their child's personal information to review and/or have the information deleted;
...
Maintain the confidentiality, security, and integrity of information they collect from children, including by taking reasonable steps to release such information only to parties capable of maintaining its confidentiality and security;
Retain personal information collected online from a child for only as long as is necessary to fulfill the purpose for which it was collected and delete the information using reasonable measures to protect against its unauthorized access or use;
The same page says that COPPA:
applies to operators of commercial websites and online services (including mobile apps and IoT devices) directed to children under 13 that collect, use, or disclose personal information from children. It also applies to operators of general audience websites or online services with actual knowledge that they are collecting, using, or disclosing personal information from children under 13. The Rule also applies to websites or online services that have actual knowledge that they are collecting personal information directly from users of another website or online service directed to children.
The FTC, some other federal agencies, and US states may enforce the COPPA Rule.
