Cybersecurity Policy Report, Newsom Signs California Bill to Strengthen Privacy Protections for Children, (Sep 11, 2026)
California Gov. Gavin Newsom (D.) this week signed a bill to revise certain requirements for businesses providing online services likely to be accessed by minors and impose new restrictions and penalties.
The new law makes changes to California’s Age-Appropriate Design Code Act (AADC) in response to court rulings that found that much of the previous law violated the First Amendment. The court enjoined certain provisions of the law—particularly those related to data protection impact assessments and vague data-use restrictions. AB 2246 therefore revises the child online protection law to withstand constitutional scrutiny.
AB 2246 removes certain exceptions while imposing stricter privacy and data protection obligations. Among other things, the new law requires businesses to estimate the age of users with reasonable certainty or apply child privacy protections to all users, set high default privacy settings for children, provide clear and age-appropriate privacy information, and offer tools for children and their guardians to exercise privacy rights.
In addition, the law prohibits profiling children by default, using personal information in ways that could cause harm or discrimination, collecting or retaining unnecessary personal data, and collecting or sharing precise geolocation data except when strictly necessary and with clear notification. It also restricts the use and retention of data collected for age estimation purposes.
The law establishes civil penalties for violations, increasing the maximum fines to $5,000 per affected child for negligent violations and $15,000 per affected child for intentional violations. All penalties collected will be deposited into a consumer privacy fund to offset enforcement costs. The law clarifies that it does not create a private right of action but allows the state attorney general to enforce the law’s provisions.
“As new technology continues to emerge and evolve, there needs to be comprehensive guardrails that protect children and their privacy while they are interacting and consuming content online. Providing more safeguards for children and their privacy is important because its misuse can expose children to harmful material, risks to their mental and physical health, and other challenges,” said Assembly member Buffy Wicks (D.), sponsor of the bill (A.B. 2246, Reg Sess.).
News: StateLegislation DataPrivacy