The California Age-Appropriate Design Code Act, enacted in 2022 as AB 2273 and codified at Cal. Civ. Code §§ 1798.99.28–1798.99.40, requires businesses providing online services likely to be accessed by children to default to the highest available privacy protections rather than to treat all users as adults absent actual knowledge otherwise. The legislature passed it unanimously. Its stated purpose, at § 1798.99.29, is to protect the "privacy, safety, and well-being of children" engaging with online products and services that "children are likely to access" (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).
The Act has never taken full effect. NetChoice sued before its effective date, and the statute has been enjoined in whole or in part continuously since 2023 (NetChoice v. Bonta (CAADCA litigation)).
Scope and coverage
The Act applies to a "business that provides an online service, product, or feature likely to be accessed by children" under eighteen (§§ 1798.99.30(b)(1), 1798.99.31(a)–(b)). For terms it does not define, it incorporates the definitions in the California Consumer Privacy Act, so a covered "business" is a for-profit entity that collects consumers' personal information, determines the purposes and means of processing it, does business in California, and meets a revenue or transaction-volume threshold (§ 1798.99.30(a), citing § 1798.140(d)).
"Likely to be accessed by children" means that "it is reasonable to expect, based on [enumerated] indicators, that the online service, product, or feature would be accessed by children" (§ 1798.99.30(b)(4)). Six disjunctive indicators supply the test:
| Indicator | § 1798.99.30(b)(4) | Test |
|---|---|---|
| A | (A) | Directed to children as defined by COPPA, 15 U.S.C. § 6501 et seq. |
| B | (B) | Routinely accessed by a significant number of children, on competent and reliable audience-composition evidence |
| C | (C) | Carries advertisements marketed to children |
| D | (D) | Substantially similar to a service covered by indicator (B) |
| E | (E) | Has design elements known to be of interest to children, "including, but not limited to, games, cartoons, music, and celebrities who appeal to children" |
| F | (F) | A significant amount of the audience is determined to be children based on internal company research |
No combination of indicators is required; any one suffices. The Ninth Circuit relied on that structure in holding the coverage definition not facially content based, distinguishing indicators (B) and (F), which turn on demographic traffic data, from (C) and (E), which may require a business to examine the content it publishes (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).
Principal obligations
Affirmative obligations under § 1798.99.31(a) include a Data Protection Impact Assessment (DPIA) report, defined as a "systematic survey to assess and mitigate risks that arise from the data management practices of the business to children who are reasonably likely to access the online service," addressing product design, algorithms, automatic playing of media and harmful content "to the extent applicable" (§§ 1798.99.30(b)(2), 1798.99.31(a)(1)(B)); age estimation "with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business," or, in the alternative, applying child-level privacy and data protections to all consumers (§ 1798.99.31(a)(5)); default high-privacy settings (§ 1798.99.31(a)(6)); a signal where an adult can monitor a child's activity (§ 1798.99.31(a)(8)); a policy enforcement requirement (§ 1798.99.31(a)(9)); and tools for exercising privacy rights and reporting concerns (§ 1798.99.31(a)(10)).
Prohibitions under § 1798.99.31(b) include using a child's personal information in a way the business knows or has reason to know is "materially detrimental to the physical health, mental health, or well-being of a child" (b)(1); profiling a child by default absent appropriate safeguards plus either necessity or a demonstrated compelling best-interests reason (b)(2); collecting, selling, sharing or retaining personal information not necessary to provide the service, absent a compelling best-interests reason (b)(3); using a child's personal information for a purpose other than that for which it was collected, absent the same showing (b)(4); using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected, to forego privacy protections, or to take any action the business has reason to know is materially detrimental (b)(7); and minimisation and purpose limitation for information collected for age estimation (b)(8). "Dark pattern" is defined by incorporation as "a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decisionmaking, or choice" (§ 1798.140(l)).
The Act also establishes a Children's Data Protection Working Group.
Enforcement
The California Attorney General enforces the Act (§ 1798.99.35(a)). Civil penalties run up to $2,500 per affected child for each negligent violation and up to $7,500 for each intentional violation. A safe harbour at § 1798.99.35(c)(2) allowed a noncompliant business 90 days from the Attorney General's written notice to cure an alleged violation and certify that it had done so; that notice-and-cure provision has been enjoined since NetChoice I (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).
Legislative history
A draft without any notice-and-cure provision was referred to the suspense file on August 1, 2022. The bill was amended on August 11, 2022 to add a 45-day cure period and again on August 22, 2022 to substitute the 90-day period ultimately enacted; those same amendments also revised the age estimation requirement, the dark patterns restriction, and exemptions for broadband internet services, telecommunications services and physical products. The committee report distinguished the Act from other federal and state child-protection statutes on the ground that those "permit online platforms to treat all consumers as adults unless there is actual knowledge that a consumer is a child" and therefore do not "offer the highest privacy protections by design and by default" (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026)).
Litigation status
| Provision | Status after March 12, 2026 |
|---|---|
| DPIA report, § 1798.99.31(a)(1)(B), and provisions not grammatically severable from it | Enjoined (NetChoice I, affirmed August 2024) |
| Notice-and-cure, § 1798.99.35(c)(2) | Enjoined |
| Data use restrictions, § 1798.99.31(b)(1)–(4) | Enjoined on vagueness grounds |
| Dark patterns restriction, § 1798.99.31(b)(7) | Enjoined on vagueness grounds |
| Coverage definition, § 1798.99.30(b)(4) | Injunction vacated; remanded |
| Age estimation, § 1798.99.31(a)(5) | Injunction vacated; remanded |
| Severability of the valid remainder | Determination vacated; remanded |
The Ninth Circuit's disposition affirms the injunction only as to §§ 1798.99.31(b)(1)–(4) and (b)(7) and vacates the remainder, returning the coverage definition, age estimation and severability to the Northern District of California (NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026), NetChoice v. Bonta (CAADCA litigation)). Holland & Knight observed in March 2026 that California had previously agreed to a temporary stay of enforcement when NetChoice renewed its challenge, so the Act may remain unenforceable for some time (Source: hklaw.com).
Relationships
- instance-of: State-Level AI Regulation — a state design-code statute preceding the AI-specific wave
- related: NetChoice v. Bonta (CAADCA litigation) — the challenge that has kept the Act from taking effect
- depends-on: NetChoice, LLC v. Bonta — Ninth Circuit opinion (No. 25-2366, March 12, 2026) — primary source for the statutory text recited here
- related: Age Verification — the age estimation requirement and its opt-out
- related: AI and Children
- related: Content vs Architecture Theory of Social Media Harm — the settings-versus-content-judgment line the litigation draws
- related: California Privacy Protection Agency (CPPA) — the state's other privacy enforcer; the CAADCA is enforced by the Attorney General rather than by the agency