California Children’s Privacy Laws (2026)

AB 1043 (2025), Ch. 675, Stats. 2025, as amended by AB 1856 (2026), Ch. 184, Stats. 2026; Civ. Code Secs. 1798.500-1798.505

Enacted, not yet effective · App store · effective 2027-01-01 · binds app stores, platforms, developers, operators

Ages: minors by age bracket (under 13, 13 to under 16, 16 to under 18)

Requires: Described as amended by AB 1856 (Ch. 184, Stats. 2026), which takes effect the same day the title becomes operative. An operating system provider whose system runs on a device with an account setup feature must have the account holder enter the primary user's birth date or age at setup, and must serve a digital signal over a reasonably consistent real-time API, on request, to a covered application store or a developer, identifying at least which bracket applies (under 13, 13 to under 16, 16 to under 18, or 18 and over) and sending no more than the minimum information needed to comply. A covered application store must request the signal from the OS provider and pass it to developers on request. A developer (a person that owns an application, or maintains or controls its hosting, in a covered application store) must request the signal when its app is downloaded onto and launched from a device, is deemed to have actual knowledge of that age range even if it willfully disregards the signal, across the app, any developer-controlled website through which the user can create an account for that app, and any point of access used to create an account or log in from the same device, and must treat the signal as the primary age indicator unless it holds clear and convincing information to the contrary. No covered entity may prompt a user to change their age information, and nobody may request a signal unless this title or another law requires it. Under 1798.502, for a device set up before 2027-01-01 the OS provider must add the interface before 2027-07-01, and for an app updated on or after 2026-01-01 and downloaded before 2027-01-01 the developer must request the signal before 2027-07-01. AG-only enforcement: injunction plus civil penalties of up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation, with good-faith safe harbors for the operating system or app store (1798.503(b)) and for developers (1798.503(c)). Distributing an operating system or application under license terms that let recipients copy, redistribute and modify the software takes a person outside 'operating system provider'.

Timing: operative 2027-01-01 under Civ. Code 1798.505, which AB 1856 does not amend; AB 1856 was approved 2026-09-10 and, as a non-urgency statute with no operative clause of its own, its amendments to Secs. 1798.500 through 1798.504 take effect 2027-01-01 under Cal. Const. art. IV, sec. 8(c)(1), so the title never operates in its 2025 form

Litigation: No challenge or injunction was identified in RECAP searches of the California federal courts and the Ninth Circuit for the act and for NetChoice and CCIA filings.

Entry last reviewed 2026-10-01

SB 976 (2024), Ch. 321, Stats. 2024; Health and Safety Code Secs. 27000-27007

In force · Social media · effective 2025-01-01 · binds operators, platforms

Ages: under 18 (minors)

Requires: Bars covered platforms from providing algorithmic 'addictive feeds' to known minors without verifiable parental consent; mandates default private mode and other minor-protective default settings; restricts overnight/school-hours notifications to minors (preliminarily enjoined; see below); from Jan 1, 2027 requires age-assurance techniques per AG regulations. Enforced solely by the AG. The notification limit (Health and Safety Code 27002(a)), the default overnight access-and-notification block (27002(b)(1)) and the annual minor-user disclosure (27005) are preliminarily enjoined, and the Ninth Circuit has ordered the like-count default (27002(b)(3)) enjoined; the feed-consent duty, the one-hour daily feed default, the non-personalized default feed and the private-mode default remain enforceable (see litigation).

Litigation: NetChoice, LLC v. Bonta (N.D. Cal. No. 5:24-cv-07885-EJD, J. Davila; 9th Cir. No. 25-146). On 2024-12-31 the district court preliminarily enjoined the overnight and school-hours notification limit (Health and Safety Code 27002(a)), the default overnight access-and-notification block (27002(b)(1)) and the annual minor-user disclosure (27005); California did not appeal that part, and it stands. On 2025-09-09 the Ninth Circuit affirmed the refusal to enjoin the personalized-feed (addictive-feed parental-consent) provisions, because NetChoice lacked associational standing for its as-applied challenge and had not built an adequate record for its facial one, held that the private-mode default survives intermediate scrutiny, held the age-assurance challenge unripe, and reversed only as to the like-count default (27002(b)(3)), remanding with instructions to enjoin it. Rehearing en banc was denied 2025-11-06 and the mandate issued 2025-11-14; no order entering the like-count injunction appears on the RECAP copy of the district docket since then, no certiorari petition appears on the Supreme Court's docket, and the district case continues. Three platform suits challenge the personalized-feed provisions (27001(a), 27002(b)(2) and 27002(b)(4)): Meta Platforms, Inc. v. Bonta, No. 5:25-cv-09792-EJD; TikTok, Inc. v. Bonta, No. 5:25-cv-09789-EJD; and Google LLC v. Bonta, No. 5:25-cv-09795-EJD (N.D. Cal., J. Davila). On 2026-08-05 the court denied their preliminary-injunction motions, holding that 'Bonta may enforce' those sections for the time being, and on 2026-08-21 it denied injunctions pending appeal. In the consolidated appeals (9th Cir. Nos. 26-5120, 26-5121 and 26-5132) a motions panel on 2026-09-17 referred the motions for an injunction pending appeal to the merits panel, so none is in effect; briefing closes with replies due 2026-11-03. Status stays in_force: the addictive-feed consent duty and the private-mode default, the Act's core, are not enjoined. NOT to be confused with No. 25-2366 (the CAADCA/AB 2273 case, J. Beth Labson Freeman, decided Mar 12, 2026).

Entry last reviewed 2026-10-01

AB 56 (2025), Ch. 671, Stats. 2025; Health and Safety Code Secs. 28000-28002 (Social Media Warning Law)

Enacted, not yet effective · Social media · effective 2027-01-01 · binds operators, platforms

Ages: All users by default; the only age line is a safe harbor for a user the platform has reasonably determined is over 17 years of age (28002(a)(1)(C), (a)(2)(C)), so the warning can be dropped only for such a user

Requires: Requires a covered platform (an addictive internet-based service or application as defined for SB 976 at Health and Safety Code 27000.5(b)(1), excluding services whose primary function is selling goods or services, cloud storage, email, private direct messaging viewable only by sender and recipient, or internal organizational communication or collaboration (28001(b))) to display a black box mental health warning to every user, not only minors: each calendar day when the user first accesses the platform (at least 25 percent of the screen or window for at least 10 seconds, dismissible by clicking a conspicuous X), again after three hours of cumulative active use and at least once per hour of cumulative active use after that (at least 75 percent of the screen or window for at least 30 seconds, with no way to bypass or click through), using the statute's fixed Surgeon General text. The duty is on by default for every user; the only relief is that a platform 'shall not be required' to warn a user it 'has reasonably determined' is 'over 17 years of age' (28002(a)(1)(C) and (a)(2)(C)), so a platform that makes no age determination must warn adults too. Showing the warning is not a defense to other claims (28002(c)); the chapter creates no private right of action (28002(d)) and names no enforcement mechanism of its own.

Litigation: No challenge or injunction was identified in RECAP searches of the California federal courts and the Ninth Circuit; the warning duty is operative 2027-01-01.

Entry last reviewed 2026-10-01

AB 2273 (2021-2022), Ch. 320, Stats. 2022, Civ. Code Secs. 1798.99.28-1798.99.40; AB 2246 (2025-2026), Ch. 187, Stats. 2026, repealing and re-adding Civ. Code Title 1.81.47 as Secs. 1798.99.28-1798.99.34

Enacted, enjoined · Design code · effective 2024-07-01 · binds operators

Ages: Children under 18 (minors)

Requires: Under the 2022 text, which governs until AB 2246 replaces it on 2027-01-01, businesses offering online services, products, or features likely to be accessed by children under 18 must estimate the age of child users or apply child protections to all users, configure default privacy settings to a high level of privacy, provide age-appropriate privacy notices, signal to a child when a parent or other user is monitoring or tracking them, not collect a child's precise geolocation by default and show an obvious sign while collecting it, and not retain age-estimation data beyond that purpose; the data protection impact assessment duty (1798.99.31(a)(1)-(2)) and the provisions left enjoined with it as nonseverable in the first appeal, including the notice-and-cure clause, remain preliminarily enjoined, as do the 'materially detrimental' use ban, the profiling-by-default, collection-and-retention and purpose limits (1798.99.31(b)(1)-(4)) and the dark-patterns ban (1798.99.31(b)(7)) after the second appeal. From 2027-01-01 the re-added Secs. 1798.99.28-1798.99.34 replace that text: the same coverage test and an age-estimation duty that says to estimate age 'pursuant to subdivision (b) of Section 1798.501' of the Digital Age Assurance Act or apply child protections to all users (because AB 1856 re-letters Section 1798.501 effective the same day, subdivision (b) is then a no-sharing rule rather than the signal provision, so the enacted cross-reference is facially mismatched and should not be read as an unambiguous signal mandate), high-privacy defaults, notices, a monitoring signal and privacy tools; prohibitions on profiling by default, unnecessary collection or sale or sharing or retention, other-purpose use (with a security and measurement safe harbor), geolocation by default or without an obvious sign, dark patterns, and retaining age-estimation data; a new duty to take reasonable steps to prevent four enumerated harms with a no-content-moderation savings clause (1798.99.30); voidability at the child's election of any provision of a contract entered into as a result of a design feature (1798.99.31); and civil penalties of up to $5,000 per affected child for each negligent violation and $15,000 for each intentional one, enforced by the Attorney General or a public prosecutor with no cure period and no private right of action (1798.99.32). The new text contains no impact-assessment, 'materially detrimental' or best-interests provisions.

Timing: the 2022 act's duties became operative 2024-07-01 under Civ. Code 1798.99.31(d) of the text now on the books. AB 2246, approved 2026-09-10 as a non-urgency statute, repeals that title and re-adds it as Civ. Code 1798.99.28 through 1798.99.34 with no operative-date clause of its own, so under Cal. Const. art. IV, sec. 8(c)(1) both the repeal and the re-added text take effect 2027-01-01; until then the 2022 text remains the statute on the books

Litigation: NetChoice, LLC v. Bonta (N.D. Cal. No. 5:22-cv-08861, J. Freeman; 9th Cir. Nos. 23-2969 and 25-2366). In the first appeal (2024) the Ninth Circuit affirmed the preliminary injunction against the data protection impact assessment requirement (Civ. Code 1798.99.31(a)(1)-(2)) and the provisions not severable from it, including the notice-and-cure clause, as a likely First Amendment violation; that injunction remains in place. On remand the district court enjoined the entire act, and on 2026-03-12 the Ninth Circuit (No. 25-2366) affirmed that injunction only insofar as it enjoined 1798.99.31(b)(1)-(4), the data-use restrictions, and 1798.99.31(b)(7), dark patterns, concluding at the preliminary-injunction stage that NetChoice had shown a likelihood of success on its vagueness challenge, and vacated the remainder, including as to the coverage definition and the age-estimation duty; the mandate issued 2026-04-03 and the case continues in the district court (last public docket entry 2026-07-02). The enjoined text is the 2022 act, which AB 2246 (Ch. 187, Stats. 2026) repeals and re-adds effective 2027-01-01: of the enjoined provisions, the impact-assessment duty, the 'materially detrimental' use ban and the cure clause have no counterpart in the new text, while the re-added provisions omit 'materially detrimental' and 'best interests' and retain revised profiling, collection, purpose-use and dark-pattern restrictions at new 1798.99.29(b)(1), (b)(2), (b)(3) and (b)(6). No court has considered whether those revisions cure the asserted defects or whether the existing injunction reaches the re-added sections, and nothing about AB 2246 appears on the public docket; the entry is classified enacted_enjoined because the injunction remains in effect, and its effect on the re-added provisions has not been decided.

Entry last reviewed 2026-10-01

Cal. Civ. Code 1798.120 (CCPA, as amended by Prop 24 / CPRA)

In force · Privacy law (minors) · effective 2020-01-01 · binds operators

Ages: Consumers known to be under 16; teens 13-15 may self-consent, children under 13 require parent/guardian consent

Requires: A business that has actual knowledge a consumer is under 16 may not sell or share that consumer's personal information unless it obtains affirmative opt-in consent: a consumer aged 13-15 may authorize the sale/sharing themselves, while for a consumer under 13 the parent or legal guardian must authorize it. Willfully disregarding a consumer's age is treated as actual knowledge, and minors are opted out by default (opt-in) rather than required to opt out.

Entry last reviewed 2026-10-01

SB 243 (2025), Ch. 677, Stats. 2025, Bus. & Prof. Code Secs. 22601-22606; amended by SB 1119 (2026), Ch. 190, Stats. 2026, which also adds Adam's Law, Bus. & Prof. Code Secs. 21810-21818

In force · AI companion · effective 2026-01-01 · binds operators

Ages: All users for the SB 243 base duties; under 18 for the minor-specific tier (Sec. 22602(c) for users the operator knows are minors until 2026-12-31; Adam's Law's 'child' tier, a natural person under 18, from 2027-01-01 for age determination and from 2027-07-01 for the child-safety duties)

AI chatbot access for minors: Off by default for minors (enacted, applies from 2027-07-01).

Requires: Operators of a 'companion chatbot' (a natural-language AI that can meet a user's social needs and sustain a relationship across interactions; customer-service bots, in-game NPCs limited to game topics and stand-alone voice assistants are carved out) must disclose the bot's artificial nature where a reasonable person would be misled into believing they are interacting with a human, maintain and publish a suicide and self-harm protocol that refers users to crisis lines, disclose that companion chatbots may not be suitable for some minors, and from 2027-07-01 report crisis-referral counts annually to the Office of Suicide Prevention; a person injured by a violation may sue for the greater of actual damages or $1,000 per violation (Sec. 22605). Until 2026-12-31, for users the operator knows are minors: disclose that the user is interacting with AI, remind the user every three hours to take a break, and take reasonable measures to prevent sexually explicit content (Sec. 22602(c)). From 2027-01-01 under Adam's Law, every operator (postsecondary institutions offering a chatbot only in educational settings and workplace-only deployments are exempt) must determine user age under the Digital Age Assurance Act, falling back to the SB 976 age determination in Health and Safety Code 27001(a)(1)(B), or else apply the child protections to all users (Sec. 21811). From 2027-07-01 an operator that bars children must publish how it complies with Sec. 21811 (Sec. 21812(b)), and operators that allow child users must complete a child-safety risk assessment before release, run a crisis protocol that notifies a parent or connects the child to 988, ship default settings that only a parent can change (no persistent conversational memory, though for 16- and 17-year-olds it may be on by default behind specified guardrails; no push notifications; one hour per session and two hours per day), give the parent controls that adjust each default and can disable access entirely for a child under 16, keep those defaults locked unless a parent account is linked to the child's account, and stop the bot from, among fourteen listed behaviors, encouraging self-harm, engaging in obscene matter or sexual abuse material with the child, or discouraging the child from seeking help; after a crisis notification or a known death or serious self-harm the operator must notify a parent where practicable and preserve the related conversation records for at least three years (Secs. 21812, 21812.5); advertising and data limits apply (Sec. 21813); independent child safety audits are due by 2029-01-01 or before a chatbot is first made publicly available, whichever is later, then every two years and before any substantial modification the risk assessment shows raises child-safety risk (Sec. 21814). Enforcement: public-prosecutor civil penalties of up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation, and a private right of action limited to actual harm from violations of Sec. 21812(d)(1)-(5) gated on over $1,000 in financial harm or serious emotional distress (Sec. 21816).

Timing: in force since 2026-01-01; the SB 1119 (Ch. 190, Stats. 2026) amendment is non-urgency with no operative clause of its own, so it takes effect 2027-01-01, when the Sec. 22602(c) known-minor duties are deleted and Adam's Law (Secs. 21810-21818) begins with the Sec. 21811 age-determination duty; the Secs. 21812, 21812.5 and 21813 child-safety duties are operative 2027-07-01 by their own terms, and the first Sec. 21814 child safety audit is due by 2029-01-01 or before a chatbot is first made publicly available, whichever is later, with operators under $500 million in prior-year gross revenue exempt from that section before 2032-01-01 (the AB 1405-contingent version of Sec. 21814 controls because AB 1405, Ch. 178, Stats. 2026, was chaptered 2026-09-09 and takes effect 2027-01-01; that version supplies the exemption)

Litigation: No federal challenge to SB 243 or SB 1119 was identified in RECAP searches of the California federal courts and the Ninth Circuit for the acts and for NetChoice and CCIA filings; SB 243 has been in effect since 2026-01-01.

Entry last reviewed 2026-10-01

AB 1709 (2025-2026), Ch. 183, Stats. 2026; Bus. & Prof. Code Secs. 22682-22686; Gov. Code Secs. 11530-11530.2

Enacted, not yet effective · Social media · effective 2027-01-01 · binds operators, platforms

Ages: under 16 (California-resident users)

Requires: A covered platform (any website, online service, or app, expressly including a social media platform, that offers an addictive feature as a significant part of its service) may not provide an addictive feature to a California-resident user under 16: an addictive feed (defined in Sec. 22682(b) in terms that track SB 976's definition), autoplay, or any other feature the Attorney General designates by regulation. Platforms must implement reasonable measures to keep under-16 users away from those features, must verify age through the Digital Age Assurance Act signal before providing an addictive feature (falling back to the SB 976 age determination in Health and Safety Code 27001(a)(1)(B) when it cannot verify age that way), and must delete the account and personal information of any under-16 user unless the platform lets that user keep a feature-free account. Sites limited to commercial transactions or consumer reviews and cloud-storage feeds are excluded. Enforced only by the Attorney General or a local public prosecutor, with no private right of action, and civil penalties of up to $50,000 per affected minor for a knowing violation and up to $25,000 per affected minor for a negligent one, with the court required to consider platform size, the severity and duration of the violation, and good-faith compliance efforts. Also creates a seven-member e-Safety Advisory Commission inside the Department of Justice that is purely advisory and reports to the Legislature and Governor by January 1 each year.

Timing: takes effect 2027-01-01 under the default rule in Cal. Const. art. IV, sec. 8(c)(1), because the chaptered text carries no operative-date clause and the bill is not an urgency statute; that is also the day the Digital Age Assurance Act signal that Sec. 22684 relies on becomes operative and the SB 976 fallback in Health and Safety Code 27001(a)(1)(B) starts. Sec. 22685 lets the Attorney General adopt regulations to implement the chapter and alter the scope of 'covered platform' by regulation so that it reaches any service making addictive features available to users under 16

Litigation: No challenge was identified in RECAP searches of the California federal courts and the Ninth Circuit. During the session a TechNet-led coalition letter signed by CCIA, NetChoice and Chamber of Progress told the Assembly Committee on Privacy and Consumer Protection it was highly likely the bill would be struck down under the First Amendment (aimed at an earlier version that banned under-16 accounts outright; the enacted text permits feature-free accounts), and EFF asked the Governor to veto it, so a pre-effective-date challenge is plausible; none is on file.

Entry last reviewed 2026-10-01

SB 867 (2025-2026), Ch. 189, Stats. 2026; Bus. & Prof. Code Secs. 22601 and 22604.5

Enacted, not yet effective · AI companion · effective 2027-01-01 · binds developers, operators

Ages: Toys designed, marketed, or manufactured for play by children under 16; the age line is in the product definition, not a user-age test

AI chatbot access for minors: Bans chatbot toys (enacted, applies from 2027-01-01).

Requires: Amends the SB 243 companion-chatbot chapter to add a definition of 'toy' (a physical product designed, marketed, or manufactured for use in play by children under 16) and a new Sec. 22604.5 under which no person may manufacture, sell, or exchange, possess with intent to sell or exchange, or expose or offer for sale or exchange to any retailer any toy that includes a companion chatbot, using SB 243's definition (a natural-language AI capable of meeting a user's social needs and sustaining a relationship across interactions, excluding customer-service bots, game-limited NPCs and stand-alone voice assistants that do not sustain a relationship). The section carries no liability clause of its own; it is numbered inside Chapter 22.6 (Secs. 22601-22606), so the existing Sec. 22605 private right of action for a violation of the chapter (injunctive relief, the greater of actual damages or $1,000 per violation, and attorney's fees) reaches it. The prohibition sunsets on 2031-01-01.

Timing: takes effect 2027-01-01 under the default rule in Cal. Const. art. IV, sec. 8(c)(1), because the chaptered text carries no operative-date clause and the bill is not an urgency statute; Sec. 22604.5(b) then repeals the prohibition by its own terms on 2031-01-01

Litigation: No challenge was identified in RECAP searches of the California federal courts and the Ninth Circuit. Reason Foundation testified against the bill during the session; no industry or trade-group challenge has been announced.

Entry last reviewed 2026-10-01

AB 1064 (2025-2026 Reg. Sess.); would have added Bus. & Prof. Code Secs. 22757.20-22757.24

Vetoed · AI companion · binds operators

Ages: Children under 18 who reside in California; before 2027-01-01 only users the operator actually knew were children, and from 2027-01-01 every user unless the operator had reasonably determined the user was not a child

AI chatbot access for minors: Bans minors (vetoed, never became law).

Requires: Would have barred an operator from making a companion chatbot available to a child unless the chatbot was not foreseeably capable of encouraging self-harm, suicidal ideation, violence, drug or alcohol use or disordered eating; offering mental health therapy without a licensed professional's supervision or discouraging the child from seeking help; encouraging harm to others or illegal activity, including creating child sexual abuse material; erotic or sexually explicit interactions; putting validation of the user's beliefs ahead of factual accuracy or the child's safety; or optimizing engagement over those guardrails. A 'companion chatbot' was a generative AI system that retains prior interactions to personalize engagement, asks unprompted emotion-based questions and sustains dialogue on personal matters, with customer-service, productivity and internal-use carve-outs. Enforcement would have been an Attorney General civil penalty of $25,000 per violation plus injunctive relief and fees, and a private action by a harmed child or parent for actual and punitive damages.

Litigation: None; vetoed before enactment. Passed the Assembly 2025-06-02 (59-12) and the Senate as amended 2025-09-10 (31-6); the Assembly concurred 2025-09-11 (60-8). Governor Newsom vetoed it 2025-10-13, writing that it 'imposes such broad restrictions on the use of conversational AI tools that it may unintentionally lead to a total ban on the use of these products by minors' and pointing to SB 243 instead; consideration of the veto was stricken from the Assembly file 2026-01-22.

Entry last reviewed 2026-10-01