Cybersecurity Policy Report, Legislation to Strengthen Privacy Protections for Children Advances in California, (May 27, 2026)
The California state Assembly has passed a bill that would impose stricter requirements and higher penalties on businesses providing online services likely to be accessed by minors.
AB 2246 proposes to strengthen the California Age-Appropriate Design Code Act by removing certain exceptions and imposing stricter privacy and data protection obligations. Among other things, the bill would require businesses to estimate the age of users with reasonable certainty or apply child privacy protections to all users, set high default privacy settings for children, provide clear and age-appropriate privacy information, and offer tools for children and their guardians to exercise privacy rights.
In addition, the bill would prohibit profiling children by default, using personal information in ways that could cause harm or discrimination, collecting or retaining unnecessary personal data, and collecting or sharing precise geolocation data except when strictly necessary and with clear notification. It would also restrict the use and retention of data collected for age estimation purposes.
The legislation would establish civil penalties for violations, increasing the maximum fines to $5,000 per affected child for negligent violations and $15,000 per affected child for intentional violations. All penalties collected would be deposited into the Consumer Privacy Fund to offset enforcement costs. The bill clarifies that it does not create a private right of action and allows the state attorney general to enforce the bill’s provisions.
The bill (A.B. 2246, Reg Sess.) is sponsored by Assembly member Buffy Wicks (D.).
News: DataPrivacy StateLegislation