Georgia Children’s Privacy Laws (2026)

SB 351 (2023-2024 Reg. Sess.) / Act 463

Enacted, enjoined · Social media · effective 2025-07-01 · binds operators, platforms

Ages: under 16

Requires: Social media platforms must make commercially reasonable efforts to verify account holders' ages, with certainty appropriate to the risks of their information-management practices, or else apply the minor protections to every account holder, and must treat anyone verified as under 16 as a minor. A Georgia resident known or reasonably believed to be under 16 may not hold an account without a parent's or guardian's express consent (signed form, toll-free call, videoconference, ID or payment-card check, email plus identity verification, or another commercially reasonable method); for minor account holders, no advertising based on personal information other than age and location, and no collection or use of personal information from their posts, messages or activity beyond what is reasonably necessary for the purpose disclosed to the minor. Parents can request a list of the platform's content-moderation features; AG-enforced only (damages up to $2,500 per violation, after a 90-day notice-and-cure period).

Litigation: NetChoice v. Carr (N.D. Ga., No. 1:25-cv-02422). PI granted June 26, 2025 (Judge Amy Totenberg), First Amendment grounds. On appeal to 11th Circuit (No. 25-12436); oral argument March 10, 2026; no appellate ruling. Injunction currently in effect.

Entry last reviewed 2026-10-01

SB 540 (2025-2026 Reg. Sess.); Act 518; adds O.C.G.A. 39-5-6

Enacted, not yet effective · AI companion · effective 2027-07-01 · binds operators

Ages: All users; minor-triggered duties when the operator knows or should know the user is a minor or the product is minor-directed

AI chatbot access for minors: Blocks features for minors (enacted, applies from 2027-07-01).

Requires: Operators of an 'AI companion chatbot' (defined by the same three-prong sustained-relationship test as Hawaii's act: retained cross-session personalization, unprompted emotion-based questions, and ongoing personal dialogue) must disclose the AI nature of the service at the start of each session and at least every three hours, tightening to hourly when the operator knows or should know the user is a minor or the product is minor-directed; for those minors, take reasonable measures against sexual content, simulated romantic or sexual relationships, and encouraging secrecy, isolation or self-harm; take reasonable measures against engagement-baiting techniques directed at minors; offer screen-time, privacy and relationship-feature controls on accounts known to belong to minors; and maintain a crisis protocol for suicide and self-harm risk, with 988 referrals, a published summary and annual referral counts. Before allowing access to any feature or mode that may generate sexually explicit content, operators must use a commercially reasonable age assurance method proportionate to the risk (age estimation, account-based assurance or ID verification), may not sell that data or use it for anything but age verification, and may not keep it longer than 24 hours unless law permits longer. AG-enforced: civil penalties up to $10,000 per knowing violation, each day a separate violation per affected user. Business, productivity and curriculum-bound tools, customer-service bots and smart speakers not designed for an emotional relationship, and game or entertainment characters confined to their subject matter are carved out.

Litigation: None (effective 2027-07-01).

Entry last reviewed 2026-10-01