California Age-Appropriate Design Code Act: Other Requirements

Requirements

Starting on July 1, 2024, a business (as defined in Cal Civ. Code § 1798.140) that provides an online service, product, or feature likely to be accessed by children shall do all of the following.

Such business shall estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of such business or apply the privacy and data protections afforded to children to all California residents.

Such business shall configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy unless the business can demonstrate a compelling reason that a different setting is in the best interests of children. "Default" means a preselected option adopted by the business for the online service, product, or feature.

Such business shall provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access that online service, product, or feature.

Such business shall enforce published terms, policies, and community standards established by the business, including, but not limited to, privacy policies and those concerning children.

If the online service, product, or feature allows the child's parent, guardian, or any other California resident to monitor the child's online activity or track the child's location, provide an obvious signal to the child when the child is being monitored or tracked.

Such business shall provide prominent, accessible, and responsive tools to help children, or if applicable, their parents or guardians, exercise their privacy rights and report concerns.

Restrictions

Starting on July 1, 2024, a business that provides an online service, product, or feature likely to be accessed by children shall not do any of the following.

Such business shall not use the personal information (as defined in Cal Civ. Code § 1798.140) of any child in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child.

Such business shall not profile a child by default unless such business can demonstrate it has appropriate safeguards in place to protect children and 1) profiling is necessary to provide the online service, product, or feature requested and only with respect to the aspects of the online service, product, or feature with which the child is actively and knowingly engaged, or 2) such business can demonstrate a compelling reason that profiling is in the best interests of children.

"Profiling" means any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Such business shall not collect (as defined in Cal Civ. Code § 1798.140), sell (as defined in Cal Civ. Code § 1798.140), share (as defined in Cal Civ. Code § 1798.140), or retain any personal information that is not necessary to provide an online service, product, or feature with which a child is actively and knowingly engaged, or as described in Cal Civ. Code § 1798.145(a)(1)-(4), unless such business can demonstrate a compelling reason that the collecting, selling, sharing, or retaining of personal information is in the best interests of children likely to access the online service, product, or feature.

If the end user is a child, such business shall not use personal information for any reason other than the reason for which that personal information was collected unless the business can demonstrate a compelling reason that the use of the personal information is in the best interests of children.

Such business shall not collect, sell, or share any precise geolocation (as defined in Cal Civ. Code § 1798.140) information of children by default unless the collection of that precise geolocation information is strictly necessary for such business to provide the service, product, or feature requested and then only for the limited time that the collection of precise geolocation information is necessary to provide the service, product, or feature.

Such business shall not collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.

Such business shall not use dark patterns (as defined in Cal Civ. Code § 1798.140) to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections or to take any action that the business knows, or has reason to know, is materially detrimental to the child's physical health, mental health, or well-being.

Such business shall not use any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age, and age assurance shall be proportionate to the risks and data practice of an online service, product, or feature.

Enforcement

Any business that violates the Act shall be subject to an injunction and liable for a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought by the California attorney general.

If a business is in substantial compliance with the requirements of Cal Civ. Code §1798.99.31(a)(1)-(4), the California attorney general shall provide written notice to such business before initiating an action under the Act, identifying the specific provisions of the Act that the California attorney general alleges have been or are being violated.

If, within 90 days of the notice required by Cal Civ. Code § 1798.99.35(c), such business cures any noticed violation and provides the California attorney general with a written statement that the alleged violations have been cured, and sufficient measures have been taken to prevent future violations, such business shall not be liable for a civil penalty for any violation cured pursuant to Cal Civ. Code § 1798.99.35(c).

Nothing in the Act shall be interpreted to serve as the basis for a private right of action under the Act or any other law.

The California attorney general may solicit broad public participation and adopt regulations to clarify the requirements of the Act.

California Children's Data Protection Working Group

Finally, the Act creates the California Children's Data Protection Working Group (consisting of 10 members, including 2 from the California attorney general and 2 from the California Privacy Protection Agency), which is to submit a report to the legislature, on or before January 1, 2024, and every 2 years thereafter, regarding best practices for the implementation of the Act. Civ. Code § 1798.99.32 shall remain in effect until January 1, 2030, and as of that date, is repealed.