Privacy & Cybersecurity Law Blog

On September 10, 2026, California’s governor signed AB 2246, a bill that repeals and replaces the California Age-Appropriate Design Code Act (“CAADCA”). AB 2246 reenacts a substantial portion of the CAADCA’s substantive requirements, without carrying forward some of its original exceptions.

Applicability

AB 2246 applies to businesses that provide an online service, product, or feature likely to be accessed by children. The bill defines a child as any consumer under 18 years of age.

A business’s online service, product, or feature is “likely to be accessed by children” if it:

• is directed to children as defined by the Children’s Online Privacy Protection Act;
• is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children;
• contains advertisements marketed to children;
• is substantially similar to or the same as an online service, product, or feature routinely accessed by a significant number of children;
• has design elements that are known to be of interest to children, including games, cartoons, music and celebrities who appeal to children; or
• determines based on internal company research that a significant amount of the audience of the online service, product, or feature is children.

An online service, product, or feature does not include a broadband Internet access service, a telecommunications service or the delivery or use of a physical product.

Key Provisions

Businesses that provide an online service, product, or feature likely to be accessed by children must:

• estimate users’ ages with reasonable certainty, as appropriate to the risks arising from the business’s data management practices pursuant to California’s Digital Age Assurance Act, or apply children’s privacy protections to all consumers;
• configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy;
• provide any privacy information, terms of service, policies and community standards concisely, prominently and using clear language suited to the age of children likely to access that online service, product, or feature;
• provide an obvious signal to the child when the child is being monitored or tracked if the online service, product, or feature allows the child’s parent, guardian or any other consumer to monitor the child’s online activity or track the child’s location;
• provide prominent, accessible and responsive tools to help children, or if applicable their parents or guardians, exercise their privacy rights and report concerns;
• if collecting precise location information of a child, provide an obvious sign to the child for the duration of the business’s collection of such information; and
• take reasonable steps to prevent reasonably foreseeable physical or financial harm, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, highly offensive intrusion on privacy rights protected by state or federal law and adverse discrimination in violation of state or federal law.
• However, this requirement is not to be construed as imposing a duty on the business to monitor, screen, or remove third-party content, restrict lawful speech, or require any specific content-ranking, recommendation, or editorial outcomes.

Businesses are prohibited from:

• profiling a child by default unless the business can demonstrate that both of the following criteria are met:
  • appropriate safeguards are in place to protect children; and
  • the profiling is necessary to (1) provide the online service, product, or feature with which the child is actively and knowingly engaged, or (2) enhance the safety, privacy, or education of a child.
• collecting, selling or sharing any precise geolocation information of children by default unless strictly necessary for the business to provide the service, product or feature requested;
  • If necessary, then the business may only collect, sell, or share the child’s precise geolocation information for the limited time that the collection of precise geolocation information is necessary to provide the service, product, or feature.
• using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forgo privacy protections; and
• retaining any personal information collected to estimate age or age range for any other purpose or retaining that personal information longer than necessary to estimate age.

Notably, any provision of a contract entered into by a child or a child’s parent or guardian is voidable at the child’s election if the contract was entered into as a result of a design feature of an online service, product, or feature likely to be accessed by children. This includes provisions of a contract or other agreement governing the terms of service for that online service, product, or feature.

Enforcement

The California Attorney General and public prosecutors may enforce AB 2246. Violations of the bill are subject to an injunction and civil penalties, assessed per affected child, of (1) up to $5,000 for each negligent violation, or (2) up to $15,000 for each intentional violation.