Cybersecurity Policy Report, Proposed Rules on Implementation of Children’s Safety Law Released in California, (May 18, 2026)

By Tony Foley

The California Department of Justice has released proposed regulations designed to implement S.B. 976 (Ch. 321), Reg Sess. (Calif. 2024), the Protecting Our Kids from Social Media Addiction Act.

The law, enacted in 2024, is aimed at protecting children online by requiring strict privacy controls and prohibiting social media platforms from sending an “addictive” social media feed to a minor without the consent of the youth’s parent or guardian (CPR, Sept. 3, 2024). The law authorized the Department of Justice to adopt regulations to further its purposes, including regulations regarding age assurance and parental consent, by Jan. 1, 2027.

The proposed rules, which were published in the California Regulatory Notice Register on Friday, would provide instructions on how a covered operator of a website, online service, or mobile application should make a reasonable determination that a user is not a minor, including using biological or behavioral signals, cryptographic techniques, government-issued identification documents, or an age assurance method satisfying the standards set forth in ISO/IEC 27566, “Information security, cybersecurity and privacy protection–Age assurance systems.” However, the proposed rule would prohibit operators from requiring users to provide government-issued identification or from using such identification as the sole method of age assurance. Finally, the proposed rules set forth instances in which an operator’s determination that a user is not a minor is not reasonable.

The proposed regulations would require operators to implement and maintain an appeals process for users to contest the operator’s determination that the user is a minor. Operators would further be required to implement a process to receive and respond to any report or information indicating that a user is a minor or that data regarding their age or location was falsified.

With respect to parental consent, the proposed regulations would provide for preliminary notification requirements for seeking verifiable parental consent, establish methods of verifiable parental consent, and dictate the contents of the required notices. They also clarify that a user’s consent for an operator to seek verifiable parental consent is revocable at any time and would require a mechanism for revocation that is at least as easy to use as the mechanism to give consent. For both age assurance and parental consent methods, the proposed rule would require operators to take reasonable steps to prevent circumvention, fraud, or misuse of the methods used.

According to its summary page for the proposed rules, the department has opened a 45-day comment period that runs through June 30. Following the comment period, the department will hold a public hearing in person and via teleconference. Instructions on submitting comments and attending the public hearing, as well as documentation relevant to the proposed rules, are available on the summary page.

News: StateLegislation DataPrivacy