California Enacts Several Minors’ Privacy and Safety Laws

Recently, California Governor Gavin Newsom signed a sweeping set of laws related to minors’ privacy and safety, including new laws that restrict covered platforms from providing certain features to users under 16, impose a duty of care on social media platforms, revise the state’s Age-Appropriate Design Code, modify the state’s age-assurance requirements governing age signals, and impose safety requirements on AI chatbots. This blog summarizes the key takeaways from these new laws.

• Age-Appropriate Design Code. AB 2246 repeals and replaces the current California Age-Appropriate Design Code Act with a revised framework that retains many of the original AADC’s core minor privacy and safety protections. The law removes the data protection impact assessment requirement and related provisions, along with the “materially detrimental” and “best interests of children” standards. The law still requires a business that “provides an online service, product, or feature likely to be accessed by children” to take reasonable steps to prevent specified risks of harm to minors, and either estimate the age of minor users with a reasonable level of certainty appropriate to the risks arising from the business’s data management practices or apply the privacy and data protections afforded to minors to all users. The law also requires default privacy settings for minor users to provide a high level of privacy and prohibit certain processing activities or practices, such as profiling or use of dark patterns.

• Age Signals. AB 1856 amends the current Digital Age Assurance Act, requiring an operating system that operates on a device and has an account setup feature to provide an accessible interface, at account setup, that requires an account holder to indicate age information of the device’s primary user. The existing law requires a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded onto, and launched from a particular device. The amended law also requires a covered application store to request a signal from the user’s operating system provider and provide the signal to a developer upon request. Additionally, the law now clarifies that “clear and convincing information” includes age information regarding the subaccount user’s age, which may be used by a developer as the primary indicator of age if it is different than the age signal. 

• Prohibited Features on Covered Platforms. AB 1709 prohibits covered platforms from providing an “addictive feature” to users under 16 and requires implementing reasonable measures to prevent under-16 users from accessing such features. “Addictive feature” is defined as a “psychologically exploitative [feature] intended to maximize engagement that foreseeably lead[s] to compulsive use,” including an “addictive feed,” further defined as a feed based on information provided by, or otherwise associated with, a user or the user’s device (with certain exceptions), autoplay, and any additional features that may be designated in future regulations adopted by the Attorney General. The law also establishes the e-Safety Advisory Commission within the Department of Justice to advise the government on matters related to online safety.

• Duty of Care. AB 2 enhances statutory damages for a “social media platform” that causes injury to a minor by failing to exercise ordinary care or skill: $5,000 per violation up to a maximum, per minor, of $1 million, or three times the amount of the minor’s actual damages, whichever is larger. The law defines “social media platform” as an internet-based service or application that substantially functions to connect users for social interaction and allows users to (1) construct a public or semi-public profile for purposes of signing into and using the service, (2) establish a list of other users with whom they share social connections, and (3) create or post content viewable by other users, and generates more than $100,000,000 in annual gross revenue.

• Companion Chatbots. Adam’s Law (SB 1119) requires operators of a “companion chatbot” to determine the age of users consistent with the Digital Age Assurance Act and imposes a series of obligations before making a new or substantially modified companion chatbot available to users, including: (1) perform and document a comprehensive risk assessment related to the design, configuration, and operation of the companion chatbot; (2) document measures that reasonably mitigate the identified minor safety risks; (3) publish a minor safety policy; (4) implement a documented crisis response protocol; (5) implement safeguards for minor users, such as usage reminders and specified disclosures; (6) implement default settings that can only be changed by a parent; (7) provide notice to minor users that they are interacting with an AI system; (8) implement measures to prevent the chatbot from engaging in certain specified behaviors; and (9) implement parental controls and a public incident reporting mechanism. Covered operators are also prohibited from displaying cross-context behavioral advertising, targeted advertising based on a minor’s personal information in a conversational chat, selling a minor’s personal information gathered through the companion chatbot, and using dark patterns. Covered operators must also perform an independent third-party minor safety audit on or before January 1, 2029, or before first making a companion chatbot available, whichever is later. Additionally, another chatbot law, SB 867, prohibits the manufacture, sale, exchange, possession with intent to sell or exchange, and exposition or offer for sale or exchange to a retailer a “toy” that includes a companion chatbot until 2031.