Skip to content

A side project I couldn’t stop researching

State Children's Privacy Law Tracker & Map (2026)

107 laws & bills · 50 states + DC · reviewed monthly

A product engineer's view of the state patchwork for shipping connected products to kids: family-safety apps, kids' wearables, and location-sharing tools used by teens, where the rules go gray. Filter the map by obligation or age, and pick a state for the detail and its primary source. It's litigation-aware: a law blocked in court shows as enjoined, not live.

As of July 18, 2026: 16 states have a kids-targeted law in force, 4 more have enacted one that is not yet effective, 4 are blocked in court, and 6 have bills pending.

Federal floor

COPPA applies in every state

15 U.S.C. §§ 6501–6506 · 16 C.F.R. Part 312 · 2025 amendments

Before collecting personal information from a child under 13, a covered operator must post a clear privacy notice, obtain verifiable parental consent, collect only what is reasonably necessary, keep it secure, give parents access and deletion rights, and not retain it longer than needed.

2025 amended Rule: The FTC’s amended COPPA Rule (finalized January 2025) adds separate opt-in parental consent before disclosing a child’s data to third parties (including for targeted advertising), a written data-retention policy that bars indefinite retention, a mandatory written information-security program, and an expanded definition of “personal information” covering biometric identifiers and government IDs. Announced by the FTC Jan 16, 2025 and published in the Federal Register Apr 22, 2025; effective June 23, 2025. The compliance deadline has passed: the final rule gave regulated entities until April 22, 2026 to comply, except as to § 312.11(d)(1), (d)(4) and (g), which ran earlier. The amended Rule is fully operative today, and the eCFR versioner shows Part 312 unamended since June 23, 2025.

Federal watch: Moving in Congress but NOT enacted (as of July 30, 2026): Senate Commerce has now noticed Executive Session 24 for August 5, 2026 at 10:00 AM in SR-253, with KOSA (S. 1748) on the markup agenda alongside S. 737, S. 4199, S. 4407 and S. 5171. The Kids Off Social Media Act (S. 278) is not on that agenda and is not awaiting markup: it was reported without amendment and placed on the Senate Legislative Calendar as No. 108 on June 30, 2025. The KIDS Act (H.R. 7757, an omnibus folding in modified KOSA and COPPA 2.0 language) passed the House 267-117 under suspension of the rules on June 29, 2026 and was referred to Senate Commerce on July 13, 2026, with no committee action since. COPPA 2.0 (S. 836) passed the Senate by unanimous consent on March 5, 2026 and has been held at the desk in the House since March 16, 2026, never referred to a House committee. Separately, the FTC’s February 25, 2026 policy statement grants COPPA enforcement discretion for personal data collected solely to verify age; it remains in force by its own terms until the Commission publishes final rule amendments or withdraws it, and no such amendments have published.

16 C.F.R. Part 3122025 final rule

States by status · tap a chip to filter the map

Statuses verified as of 2026-07-18

Building a connected product for kids?

Location · design · analytics · consent: the four buckets that drive the engineering work.

Family-safety apps, kids’ smartwatches, and location-sharing tools collect exactly the data these laws govern, and they’re used by teens, where the rules get gray. Use the map’s Obligation lens to see which states impose each one.

  • Location & geolocation

    Precise location is sensitive data: notice and consent before you collect or share it, and limits on sharing a minor’s location.

    Driven by: Age-Appropriate Design Codes and the omnibus privacy laws, which treat precise geolocation as sensitive data.

  • Age-appropriate design

    High-privacy defaults for minors, no dark patterns, and a duty to assess risks before you ship a feature.

    Driven by: Age-Appropriate Design Codes and the minor social-media laws (defaults, no addictive feeds, no dark patterns).

  • Analytics & third parties

    You can’t freely drop in usage-telemetry or marketing SDKs on a child’s data: separate consent for third-party sharing, and bans on targeted ads and data sale to minors.

    Driven by: COPPA’s 2025 amendments (separate consent for third-party sharing), the privacy-law teen opt-ins, and minor social-media targeted-ad bans.

  • Consent & minimization

    Verifiable parental consent for younger children, teen opt-in above that, and collect only what the feature actually needs.

    Driven by: COPPA, the App Store Accountability Acts, and the teen opt-in provisions layered on top.

Operating nationwide? Comply to the high-water mark

Age thresholds don’t conflict; they stack. Meet the strictest per obligation.

These age thresholds don’t contradict each other; they stack, and they’re per-obligation. A product available in all 50 states has to meet the strictest threshold for each kind of duty, not the average.

  • Under 13

    Any data collection

    Verifiable parental consent before you collect a child’s personal information: COPPA, federal, every state. The 2025 amended Rule adds opt-in for third-party sharing and limits on retention.

  • Under 16–17

    Selling data · targeted ads · profiling

    Opt-in consent before you monetize teen data. California draws the sale/share line at under-16; Connecticut and Oregon at under-16; Montana, Delaware and New Jersey reach 16–17; Colorado, Maryland and New York extend duties to under-18.

  • Under 18

    App distribution · accounts · design defaults

    Parental consent to download or buy apps under the App Store Accountability Acts (Texas, Utah, Louisiana…), plus high-privacy defaults and duty-of-care under the Age-Appropriate Design Codes.

The practical upshot: an app that gates only at 13 (“we’re COPPA-compliant”) is still exposed to Texas’s under-18 app-store consent regime (SB 2420), where the burden of proof falls on the developer. Treat under-18 as the protected class for distribution and design, give under-13 the full COPPA treatment for any collection, and assume under-16/17 opt-in before you monetize teen data.

Every tracked law, by status

What's live, what's coming, what's blocked, what's pending, all 107 laws & bills.

In force · 41

  • Arkansas: Children and Teens' Online Privacy Protection Act (HB 1717 / Act 952 of 2025) (HB 1717 / Act 952)
  • California: SB 976: Protecting Our Kids from Social Media Addiction Act (SB 976)
  • California: California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA): minors' provisions (Cal. Civ. Code 1798.120 (CCPA, as amended by Prop 24 / CPRA))
  • California: Companion chatbot safeguards (SB 243) (SB 243 (2025), Ch. 677, Stats. 2025; Bus. & Prof. Code Secs. 22601-22605)
  • Colorado: Colorado Privacy Protections for Children's Online Data (SB24-041): child data-protection / AADC-style provisions (SB24-041)
  • Connecticut: Connecticut minors' online data protection framework (CTDPA §§ 42-529a to 42-529b), as enacted by SB 1295 / Public Act 25-113 (SB 1295 (Public Act 25-113))
  • Connecticut: Connecticut Data Privacy Act (CTDPA): minors' provisions (SB 6 (2022, Public Act 22-15); amended by SB 3 (2023, Public Act 23-56))
  • Delaware: Delaware Personal Data Privacy Act: minors' provisions (HB 154)
  • Florida: HB 3 (2024): Online Protections for Minors (social media account restrictions, Fla. Stat. s. 501.1736)
  • Florida: Florida Digital Bill of Rights (SB 262): minors' provisions (Fla. Stat. 501.702/501.71x) (SB 262 (2023))
  • Hawaii: Artificial Intelligence Disclosure and Safety Act: AI companion provisions (SB 3001 CD1; Act 248, Session Laws of Hawaii 2026)
  • Idaho: Stop Harms from Addictive Social Media Act (HB 542 / Session Law Chapter 268) (HB 542 (H0542), 2026 Reg. Sess.; Session Law Chapter 268)
  • Indiana: Indiana Consumer Data Protection Act: minors' provisions (SB 5 (2023))
  • Iowa: Iowa Consumer Data Protection Act (ICDPA): minors' provisions (SF 262)
  • Kentucky: Kentucky Consumer Data Protection Act (KCDPA): minors' provisions (HB 15 (2024 RS))
  • Louisiana: Targeted Advertising / Minors' Data Protection Act (HB 577, 2024 RS, Act 656)
  • Louisiana: Kids Online Protection and Anti-Grooming Act (HB 37, 2025 RS, Act 236)
  • Maryland: Maryland Age-Appropriate Design Code Act (Maryland Kids Code) (SB 571 / HB 603 (2024, Ch. 460))
  • Maryland: Maryland Online Data Privacy Act of 2024 (MODPA): minors' provisions (SB 541 (2024, Ch. 455; cross-filed HB 567))
  • Minnesota: Minnesota Consumer Data Privacy Act (MCDPA): minors' provisions (HF 4757 (2024, Ch. 121))
  • Minnesota: Minnesota Social Media Mental Health Warning Label Law (HF 2 (2025 First Special Session, Minn. Laws 1Sp2025 ch. 3, art. 19, sec. 13; codified as Minn. Stat. 325M.335))
  • Mississippi: HB 1126 (2024): Walker Montgomery Protecting Children Online Act (HB 1126 (2024 Regular Session))
  • Mississippi: HB 1224 (2026): Mississippi Keeping Kids Safe Online Act (HB 1224 (2026 Regular Session))
  • Montana: Montana Consumer Data Privacy Act: minors' protections (SB 297 amendments, Ch. 567, Laws of 2025) (SB 297 (Ch. 567, Laws of 2025); MCDPA codified at MCA 30-14-2801 et seq.)
  • Nebraska: Nebraska Age-Appropriate Online Design Code Act (LB 504), as amended by LB 838 (LB 504 (2025), as amended by LB 838 (2026))
  • Nebraska: Nebraska Data Privacy Act: minors' provisions (LB1074)
  • New Hampshire: New Hampshire Data Privacy Act (RSA 507-H, enacted via SB 255): minors' provisions (SB 255 (2024); codified at RSA 507-H)
  • New Jersey: New Jersey Data Privacy Act: minors' provisions (S332 (P.L. 2023, c. 266))
  • New York: New York Child Data Protection Act (S7695B (Ch. 121 of 2024))
  • New York: Artificial Intelligence Companion Models law (GBL Article 47) (Part U of the FY2026 budget (S3008-C/A3008-C), Chapter 58 of 2025; GBL Secs. 1700-1702)
  • Ohio: Social Media Parental Notification Act (HB 33, 135th GA budget; codified at R.C. 1349.09) (HB 33 (135th GA))
  • Oregon: Oregon Consumer Privacy Act (OCPA): minors' provisions (SB 619 (2023), as amended by HB 2008 (2025))
  • Rhode Island: Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA): minors' provisions (H7787 / S2500 (2024))
  • South Carolina: South Carolina Age-Appropriate Code Design Act (H.3431 / Act No. 96, R100) (H.3431 (Act No. 96, R100))
  • Tennessee: Protecting Children from Social Media Act (HB 1891 / SB 2097, 113th GA) (HB 1891 (113th GA) / Public Chapter 899)
  • Tennessee: Tennessee Information Protection Act (TIPA): minors' provisions (SB 73 / HB 1181)
  • Texas: App Store Accountability Act (SB 2420)
  • Texas: Securing Children Online through Parental Empowerment (SCOPE) Act (HB 18)
  • Texas: Texas Data Privacy and Security Act (TDPSA): minors' provisions (HB 4 (88th Leg., R.S.))
  • Utah: Utah Consumer Privacy Act (UCPA): minors' provisions (S.B. 227 (2022 General Session))
  • Virginia: Virginia Consumer Data Protection Act: minors' provisions (SB 361 / HB 707 (Chapter 844, 2024))

Enacted, not yet effective · 26

  • Alabama: App Store Accountability Act (HB161 (Act 2026-59)) · effective 2027-01-01
  • Alabama: Alabama Personal Data Protection Act (APDPA) (HB351 (Act 2026-552)) · effective 2027-05-01
  • California: AB 1043: Digital Age Assurance Act (AB 1043) · effective 2027-01-01
  • California: AB 56: Social media: warning labels (AB 56) · effective 2027-01-01
  • Colorado: SB26-051: Age Attestation on Computing Devices · effective 2028-07-01
  • Colorado: Conversational Artificial Intelligence Service Operator Requirements (HB26-1263) (HB26-1263 (Chapter 208, 2026 Session Laws)) · the act takes effect 2026-08-12, ninety days after the General Assembly's 2026-05-13 sine die adjournment, and is subject to a referendum petition filed within that window. The duties phase in: the age-estimation duty in C.R.S. 6-1-1708 (2) carries no date qualifier and so attaches on 2026-08-12, while the minor-specific duties, the consumer AI disclosure, the suicide and self-harm protocol and the false-representation ban all apply on and after 2027-01-01, and annual reporting to the Attorney General begins 2027-07-01. For a team shipping a kids' product the operational deadline is 2027-01-01
  • Connecticut: An Act Concerning Online Safety (Substitute Senate Bill No. 5 / Public Act No. 26-15), Sec. 39: social media covered-platform minor protections (SB 5 (2026); Public Act No. 26-15) · effective 2028-01-01
  • Connecticut: An Act Concerning Online Safety (Public Act No. 26-15), Secs. 4-6: AI companion safeguards (SB 5 (2026); Public Act No. 26-15, Secs. 4-6) · effective 2027-01-01
  • Georgia: Georgia Conversational AI Safety Act (SB 540) (SB 540 (2025-2026 Reg. Sess.); Act 518; adds O.C.G.A. 39-5-6) · effective 2027-07-01
  • Idaho: Conversational AI Safety Act (S 1297) (S 1297 (Session Law Chapter 249); Idaho Code § 48-2101 [48-2201] et seq.) · effective 2027-07-01
  • Indiana: House Enrolled Act 1408 (2026): Restricting Minor Access to Social Media (HB 1408 / HEA 1408 (2026); Public Law 100) · effective 2027-01-01
  • Iowa: Conversational AI service requirements (SF 2417) (SF 2417 (Iowa Acts 2026 ch. 1068); Iowa Code ch. 554J) · the act took effect 2026-07-01 by default under Iowa Code § 3.7, but section 7 provides that it applies 2027-07-01, so no operator obligation attaches until then
  • Louisiana: App Store Accountability Act (HB 570, 2025 RS, Act 481, as amended by HB 977, 2026 RS, Act 185) (HB 977 (Act 185), amending HB 570 (Act 481)) · effective 2027-07-01
  • Louisiana: Louisiana Data Privacy Act (SB 386, 2026 RS, Act 502) (SB 386 (Act 502)) · core obligations effective 2027-01-01, when exclusive Attorney General enforcement also begins (there is no private right of action). From 2027-01-01 through 2027-07-31 the AG must give at least 30 days' written notice and an opportunity to cure before acting. That mandatory cure right sunsets 2027-07-31, so from 2027-08-01 the AG may bring an enforcement action without offering a cure, and any cure becomes discretionary
  • Minnesota: Stop Harms from Addictive Social Media Act amendments (HF 4138) (HF 4138 (2026 Minn. Laws ch. 111)) · effective 2027-07-01
  • Nebraska: Conversational Artificial Intelligence Safety Act (LB 525, Secs. 12 to 18) (LB 525 (2026), Secs. 12 to 18; Sec. 19 sets the operative date) · Sec. 19 makes the Act's sections operative on a specified date, 2027-07-01, rather than Nebraska's default three months after sine die
  • New Hampshire: New Hampshire HB 1460: prohibition on the sale of a child's personal data (amending RSA 507-H) (HB 1460 (2026), Chapter 168) · effective 2027-01-01
  • New York: Stop Addictive Feeds Exploitation (SAFE) For Kids Act (S7694A / A8148A (Chapter 120 of 2024); GBL Article 45) · the rulemaking that gates this Act is DONE, and the clock has started. The Attorney General adopted the implementing rules (addition of Part 700 to Title 13 NYCRR) by Notice of Adoption LAW-39-25-00001-A, Filing No. 688, published in the New York State Register of 2026-07-29 (Vol. XLVIII, Issue 30). This closes the 2026-10-01 lapse risk the entry previously flagged. Two official instruments then disagree by 15 days on when the Act takes effect. 13 NYCRR 700.11 sets it at the 180th day after publication in the State Register, which is 2027-01-25, and that is the date the Attorney General states publicly. The Register's own notice records a Filing Date of 2026-07-14 and an effective date of '180 days after filing', which computes to 2027-01-10. This entry publishes 2027-01-25 because the rule text and the Attorney General agree on it, but a conservative compliance plan should assume 2027-01-10
  • New York: Safe by Design Act (NY) (S9008C/A10008C (TED budget bill), Chapter 58 of the Laws of 2026; GBL Article 45-B (originally introduced as the standalone Stop Online Predators Act, S4609/A6549)) · effective 2027-01-01
  • Oregon: Artificial intelligence companions (SB 1546) (SB 1546 (Oregon Laws 2026 ch. 85)) · effective 2027-01-01
  • Rhode Island: Artificial Intelligence Companion Models act (S 2195 Sub A / H 7350 Sub A) (S 2195 Substitute A as amended (Public Laws 2026 ch. 376; identical House companion H 7350 Sub A is ch. 375); R.I. Gen. Laws ch. 6-63) · enacted 2026-06-22 (the Public Laws chapter header records enactment; Rhode Island's records do not distinguish a governor's signature from passage without one, so no signed date is asserted); effective 2027-01-01
  • South Carolina: Stop Harm from Addictive Social Media (SHASM) Act (H.4591 / Act No. 237 (R.251)) · effective 2027-01-01
  • Utah: App Store Accountability Act (SB 142 (2025), amended by HB 498 (2026)) · effective 2027-05-06
  • Vermont: Vermont Age-Appropriate Design Code Act (S.69 (Act 63)) · effective 2027-01-01
  • Vermont: Vermont Data Privacy and Online Surveillance Act: minors' provisions (S.71 (Act 145)) · effective 2028-01-01
  • Washington: AI Companion Chatbots law (ESHB 2225) (ESHB 2225 (Chapter 168, Laws of 2026); the act carries no short title) · effective 2027-01-01

Enacted, enjoined · 10

  • Arkansas: Social Media Safety Act (SB 396 / Act 689 of 2023)
  • Arkansas: Social Media Safety Act amendment (SB 611 / Act 900 of 2025)
  • Arkansas: Regulation of Social Media Platform Design (SB 612 / Act 901 of 2025)
  • California: California Age-Appropriate Design Code Act (CAADCA) (AB 2273 (2021-2022), Chapter 320)
  • Colorado: HB24-1136: Healthier Social Media Use by Youth
  • Georgia: SB 351: Protecting Georgia's Children on Social Media Act of 2024 (Act 463), social media provisions (SB 351 (2023-2024 Reg. Sess.) / Act 463)
  • Louisiana: Secure Online Child Interaction and Age Limitation Act (SB 162, 2023 RS, Act 456)
  • Nebraska: Parental Rights in Social Media Act (LB 383) (LB 383)
  • Utah: Utah Minor Protection in Social Media Act (SB 194 / HB 464 (2024))
  • Virginia: SB 854: Consumer Data Protection Act; social media platforms, minors (SB 854 (2025))

Pending · 29

  • California: AB 1856: amendments to the Digital Age Assurance Act (AB 1043) (AB 1856)
  • Illinois: Children's Online Social Media Safety Act (HB 5511) (HB 5511)
  • Illinois: Parental Consent for Social Media Act (SB 2316) (SB 2316)
  • Illinois: Illinois Age-Appropriate Design Code Act (SB51)
  • Massachusetts: An Act protecting children from social media and prohibiting cell phones in schools (House youth technology / social media age-verification bill) (S.2581, "An Act to promote student learning and mental health" (House version engrossed as H.5366; now in a House-Senate conference committee))
  • Massachusetts: An Act protecting children from addictive social media feeds (S.3164, reprinted as amended and engrossed as S.3175)
  • Michigan: SB 757 (2025-2026): Stop Addictive Feeds Exploitation (SAFE) for Kids Act
  • Michigan: SB 758 (2025-2026): Kids Over Clicks (minor data protection)
  • Michigan: SB 759 (2025-2026): Kids Over Clicks (minor data/privacy)
  • Michigan: SB 760 (2025-2026): Leading Ethical AI Development (LEAD) for Kids Act
  • Michigan: HB 4388 (2025-2026): Social Media Regulation / Protection Act (minors)
  • Michigan: SB 190 (2025-2026): Social Media Children Protection Act
  • Michigan: HB 4429 (2025-2026): Digital Age Assurance Act
  • Michigan: SB 284 (2025-2026): Digital Age Assurance Act
  • Michigan: Michigan Age-Appropriate Design Code Act (MI Kids Code) (HB 5357)
  • Michigan: Michigan Personal Data Privacy Act: minors' provisions (SB 359)
  • New Jersey: S3993: Requires age verification and parental/guardian consent for a minor's use of a social media platform; prohibits certain adult-minor messaging (222nd Legislature, 2026-2027 session) (S3993 (222nd Legislature, 2026-2027))
  • New Jersey: New Jersey Kids Code Act (Age-Appropriate Design Code for New Jersey) (S3413 (Senate); A4015 (Assembly companion))
  • New York: App Store / Device Age-Assurance Act (operating system / app store age verification) (S8102-B (2025-2026 session, Sen. Gounardes); A8893)
  • New York: Unsafe AI companion features prohibition (S 9051-B / A 10379-C) (S 9051-B, substituted for A 10379-C; would add GBL Article 48, §§ 1800-1805. The print carries no short title)
  • North Carolina: Social Media and AI Safety Act (HB 301) (HB 301 (2025-2026 Session))
  • Ohio: App Store Accountability Act (HB 226 / SB 167, Meta-backed; competing HB 302 / SB 175, Google-backed; 136th GA) (HB 226 / SB 167 (136th GA); also HB 302 / SB 175)
  • Pennsylvania: Protection of Minors on Social Media (Senate companion) (SB 22)
  • Pennsylvania: Protection of Minors on Social Media (House companion) (HB 1430)
  • Pennsylvania: Children's Online Safety Act (HB 1729)
  • Pennsylvania: Guidelines for User Age Verification and Responsible Dialogue (AI for Children) (HB 2215)
  • Tennessee: App Store Accountability Act (HB 2254, 114th GA) (HB 2254 (114th GA))
  • Virginia: SB 237 / HB 757: App Store Accountability Act (SB 237 (companion HB 757), 2026 session)
  • Virginia: Consumer Data Protection Act; prohibitions and duties relating to minors (SB 232 (2026))

Vetoed · 1

  • Arizona: Artificial intelligence service disclosures bill (HB 2311) (HB 2311 (2026, 57th Leg., 2nd Reg. Sess.))

Not legal advice. I build products for a living; I'm not a lawyer. This is a personal tool I use to stay on top of the child-privacy landscape and understand how it shapes the features, apps, and products I design in the kids space, not guidance for anyone else. It's AI-assisted research, and AI can make mistakes: I make every effort to verify, check, and confirm each entry against primary sources, and every entry has been checked on or after July 18, 2026, but laws, and especially injunctions, change fast, so always confirm the latest on each law against the linked source before relying on it. Each law card carries its own checked-on date. Related: COPPA's Gray Areas · all writing.

Link or cite this tracker

Free to reference and reuse with attribution. The data refreshes monthly; court-order changes land within the week. See what changed in the changelog.

Calvo, Isaac A. State Children's Privacy Law Tracker & Map (2026). https://isaaccalvo.com/child-privacy-laws (data as of 2026-07-18; reviewed monthly).

Prefer the raw data? The full dataset is free under CC BY 4.0 (attribution with a link back here): download JSON. Sharing on social pulls a live map card generated from this same dataset.