Cybersecurity Policy Report, Stronger Privacy Protections for Children Advance in California, (Jun 17, 2026)
The California state Senate Privacy, Digital Technologies, and Consumer Protection Committee voted 8-0 this week to pass a bill that would revise certain requirements for businesses providing online services likely to be accessed by minors and impose new restrictions and penalties.
The bill seeks to make changes to California’s Age-Appropriate Design Code Act (AADC) in response to court rulings which found that much of the previous law violates the First Amendment. The court enjoined certain provisions of the law—particularly those related to data protection impact assessments (DPIAs) and vague data-use restrictions.
“This bill simply replicates the AADC in new code sections, removing the various provisions or terms in the law that the Ninth Circuit has found unconstitutional, such as the DPIA requirements (and their attendant provisions) and the terms found unconstitutionally vague, such as ‘the best interests of the child; and ‘materially detrimental,’” according to the committee.
AB 2246 proposes to remove certain exceptions while imposing stricter privacy and data protection obligations. Among other things, the bill would require businesses to estimate the age of users with reasonable certainty or apply child privacy protections to all users, set high default privacy settings for children, provide clear and age-appropriate privacy information, and offer tools for children and their guardians to exercise privacy rights.
In addition, the bill would prohibit profiling children by default, using personal information in ways that could cause harm or discrimination, collecting or retaining unnecessary personal data, and collecting or sharing precise geolocation data except when strictly necessary and with clear notification. It would also restrict the use and retention of data collected for age estimation purposes.
The legislation would establish civil penalties for violations, increasing the maximum fines to $5,000 per affected child for negligent violations and $15,000 per affected child for intentional violations. All penalties collected would be deposited into a consumer privacy fund to offset enforcement costs. The bill clarifies that it does not create a private right of action but allows the state attorney general to enforce the bill’s provisions.
The bill (A.B. 2246, Reg Sess.) is sponsored by Assembly member Buffy Wicks (D.). It has been referred to the Senate Judiciary Committee.
News: DataPrivacy StateLegislation