Cybersecurity Policy Report, Legislation to Strengthen Privacy Protections for Children Sent to California Governor, (Sep 10, 2026)
A bill that would revise certain requirements for businesses providing online services likely to be accessed by minors and impose new restrictions and penalties has been sent to Gov. Gavin Newsom (D.) for his signature.
The bill seeks to make changes to California’s Age-Appropriate Design Code Act (AADC) in response to court rulings that found that much of the previous law violated the First Amendment. The court enjoined certain provisions of the law—particularly those related to data protection impact assessments and vague data-use restrictions. AB 2246 would therefore revise the child online protection law to withstand constitutional scrutiny.
AB 2246 proposes to remove certain exceptions while imposing stricter privacy and data protection obligations. Among other things, the bill would require businesses to estimate the age of users with reasonable certainty or apply child privacy protections to all users, set high default privacy settings for children, provide clear and age-appropriate privacy information, and offer tools for children and their guardians to exercise privacy rights.
In addition, the bill would prohibit profiling children by default, using personal information in ways that could cause harm or discrimination, collecting or retaining unnecessary personal data, and collecting or sharing precise geolocation data except when strictly necessary and with clear notification. It would also restrict the use and retention of data collected for age estimation purposes.
The legislation would establish civil penalties for violations, increasing the maximum fines to $5,000 per affected child for negligent violations and $15,000 per affected child for intentional violations. All penalties collected would be deposited into a consumer privacy fund to offset enforcement costs. The bill clarifies that it does not create a private right of action but allows the state attorney general to enforce the bill’s provisions.
The bill (A.B. 2246, Reg Sess.) was sponsored by Assembly member Buffy Wicks (D.).
News: StateLegislation DataPrivacy