California Children's Privacy Laws (2026)

AB 1043: Digital Age Assurance Act · AB 1043

Enacted, not yet effective: Signed into law; its effective date is still in the future. · App store · effective 2027-01-01 · binds app stores, platforms, developers, operators

Ages: minors by age bracket (under 13, 13-15, 16-17)

Requires: Requires OS providers to collect a user's birth date/age at account setup and pass an age-bracket signal via a real-time API to apps available in covered app stores; app developers must request and use that signal as a primary age indicator. AG-enforced civil penalties ($2,500 negligent / $7,500 intentional per affected child).

Litigation: No litigation filed or injunction entered.

Entry last reviewed 2026-07-18

SB 976: Protecting Our Kids from Social Media Addiction Act · SB 976

In force: Effective and enforceable today. · Social media · effective 2025-01-01 · binds operators, platforms

Ages: under 18 (minors)

Requires: Bars covered platforms from providing algorithmic 'addictive feeds' to known minors without verifiable parental consent; mandates default private mode and other minor-protective default settings; restricts overnight/school-hours notifications to minors; from Jan 1, 2027 requires age-assurance techniques per AG regulations. Enforced solely by the AG.

Litigation: NetChoice, LLC v. Bonta, No. 25-146 (9th Cir.): Sept 9, 2025 panel UPHELD addictive-feed consent + default-private-mode provisions, enjoined ONLY the like-count/engagement-metrics provision; en banc rehearing DENIED Nov 6, 2025. No petition for certiorari was filed with the U.S. Supreme Court within the 90-day window that followed (deadline approx. Feb 4, 2026), so the Ninth Circuit panel ruling is now final on SB 976; the underlying district court case, D.C. No. 5:24-cv-07885-EJD (N.D. Cal., J. Davila), continues on the merits. NOT to be confused with No. 25-2366 (the CAADCA/AB 2273 case, J. Beth Labson Freeman, decided Mar 12, 2026).

Entry last reviewed 2026-07-18

AB 56: Social media: warning labels · AB 56

Enacted, not yet effective: Signed into law; its effective date is still in the future. · Social media · effective 2027-01-01 · binds operators, platforms

Ages: under 18 (minors)

Requires: Requires covered social media platforms to display a black-box mental-health warning to minor users on first daily access (>=25% of screen, >=10 seconds), again after 3 cumulative hours of use (non-dismissible, >=75% of screen, 30 seconds), and at least hourly thereafter, using prescribed Surgeon-General warning text.

Litigation: No suit filed; industry anticipates a likely compelled-speech First Amendment challenge before the Jan 1, 2027 effective date, but none is on file.

Entry last reviewed 2026-07-18

California Age-Appropriate Design Code Act (CAADCA) · AB 2273 (2021-2022), Chapter 320

Enacted, enjoined: Passed, but a court has currently blocked enforcement. · Design code · effective 2024-07-01 · binds operators

Ages: Children under 18 (minors)

Requires: Businesses offering online products/services likely to be accessed by children under 18 must configure default privacy settings to a high level of privacy for child users, estimate the age of child users or apply child protections to all users, provide age-appropriate privacy notices, and limit collection/use of children's personal data and precise geolocation. Core duties (data protection impact assessments, the 'materially detrimental to well-being'/best-interests data-use limits, profiling-by-default restrictions, and dark-patterns prohibitions) are currently blocked by court injunction and not enforceable.

Litigation: NetChoice, LLC v. Bonta (9th Cir.). On March 12, 2026 the Ninth Circuit vacated the district court's blanket preliminary injunction but held that the DPIA/risk-assessment requirement, the data-use 'materially detrimental'/best-interests limits, profiling-by-default restrictions, and dark-patterns provisions remain enjoined as unconstitutionally vague; the age-estimation, high-default-privacy-settings, child-appropriate privacy-policy, geolocation, and related provisions are no longer enjoined. Remanded to N.D. Cal. for further proceedings on age estimation and severability; the act is partially enjoined, not wholly blocked.

Entry last reviewed 2026-07-18

California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA): minors' provisions · Cal. Civ. Code 1798.120 (CCPA, as amended by Prop 24 / CPRA)

In force: Effective and enforceable today. · Privacy law (minors) · effective 2020-01-01 · binds operators

Ages: Consumers known to be under 16; teens 13-15 may self-consent, children under 13 require parent/guardian consent

Requires: A business that has actual knowledge a consumer is under 16 may not sell or share that consumer's personal information unless it obtains affirmative opt-in consent: a consumer aged 13-15 may authorize the sale/sharing themselves, while for a consumer under 13 the parent or legal guardian must authorize it. Willfully disregarding a consumer's age is treated as actual knowledge, and minors are opted out by default (opt-in) rather than required to opt out.

Entry last reviewed 2026-07-18

AB 1856: amendments to the Digital Age Assurance Act (AB 1043) · AB 1856

Pending: A bill was introduced this cycle but is not yet law. · App store · binds app stores, platforms, developers, operators

Ages: minors by age bracket (under 13, 13-15, 16-17)

Requires: Amends AB 1043 (the Digital Age Assurance Act) before it takes effect. As amended in the Senate on July 1, 2026, AB 1856 exempts open-source operating systems (any software licensed to allow copying, redistribution, and modification) from the definition of 'operating system provider,' after earlier Assembly versions drew criticism for expanding age-signal collection to web browsers and websites; that browser/website expansion was dropped following opposition from digital rights groups. Passed the Assembly 68-1 on May 26, 2026; it was reported unanimously by the Senate privacy committee on 2026-06-30 and re-referred to the Senate Appropriations Committee on 2026-07-01, where it is pending.

Entry last reviewed 2026-07-18

Companion chatbot safeguards (SB 243) · SB 243 (2025), Ch. 677, Stats. 2025; Bus. & Prof. Code Secs. 22601-22605

In force: Effective and enforceable today. · AI companion · effective 2026-01-01 · binds operators

Ages: All users; specific duties for users the operator knows are minors

Requires: Operators of a 'companion chatbot' (a natural-language AI capable of meeting a user's social needs, including by exhibiting anthropomorphic features and sustaining a relationship across multiple interactions) must disclose the artificial nature of the bot where a reasonable person could be misled, and maintain a protocol against producing suicidal-ideation, suicide, or self-harm content. For users the operator knows are minors: disclose that the user is interacting with AI, provide a default break reminder at least every three hours, and apply sexual-content restrictions. Express carve-outs: customer-service and operational bots, in-game NPCs limited to game topics, and stand-alone voice-assistant devices that do not sustain a relationship. Includes a private right of action.

Litigation: No lawsuit identified challenging SB 243. In effect since 2026-01-01.

Entry last reviewed 2026-07-18