Privacy & Information Security Law Blog

On September 15, 2022, California Governor Gavin Newsom signed into law the California Age-Appropriate Design Code Act (the “Act”). The Act, which takes effect July 1, 2024, places new legal obligations on companies with respect to online products and services that are “likely to be accessed by children” under the age of 18.

The Act is modeled on the UK’s Age-Appropriate Design Code. The Act applies to businesses that provide an online service, product or feature “likely to be accessed by children” under the age of 18 (“covered businesses”). An online service, product or feature is “likely to be accessed by children” based on certain indicators, including whether:

• It is “directed to children,” as defined by the federal Children’s Online Privacy Protection Act (“COPPA”);
• It is determined to be routinely accessed by a significant number of children (based on competent and reliable evidence regarding audience composition);
• It has advertisements marketed to children;
• It is substantially similar to, or the same as, an online service, product, or feature routinely accessed by a significant number of children;
• It has design elements that are known to be of interest to children (including, but not limited to, games, cartoons, music, and celebrities who appeal to children); or
• A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.

The “likely to be accessed by children” standard is much broader than COPPA, which applies to operators of websites or online services that (1) are either directed to children or (2) have actual knowledge are collecting personal information from children online. The Act also defines “child” more broadly; COPPA defines “child” as an individual under the age of 13, while the Act defines “child” as a consumer who is under the age of 18. Additionally, the Act imposes a number of requirements on covered businesses that are not included under COPPA.

Requirements

Among other obligations, the Act requires covered businesses to:

• Configure all default privacy settings offered by the online service, product or feature to those that offer a high level of privacy, unless the business can demonstrate a compelling reason that a different setting is in the best interests of children;
• Concisely and prominently provide privacy information, terms of service, policies and community standards, using clear language suited to the age of the children likely to access the online service, product or feature;
• Before any new online service, product or feature that is likely to be accessed by children is offered to the public, complete a Data Protection Impact Assessment (“DPIA”), and, upon written request, provide the DPIA to the California Attorney General;
• Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the business’s data management practices, or apply the privacy and data protections afforded to children to all consumers;
• If the online service, product or feature allows the child’s parent, guardian or any other consumer to monitor the child’s online activity or track the child’s location, provide an obvious signal to the child when the child is being monitored or tracked;
• Enforce published terms, policies and community standards established by the business, including, but not limited to, privacy policies and those concerning children; and
• Provide prominent, accessible and responsive tools to help children (or their parents/guardians) to exercise their privacy rights and report concerns.

Prohibited/Restricted Activities

• Covered businesses are prohibited from using a child’s personal information:
  • for any reason other than a reason for which the personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the “best interests of children;” or
  •  in a way that the business knows, or has reason to know, is materially detrimental to the physical health, mental health, or well-being of a child.

The Act also places restrictions on the profiling of children, use of dark patterns, and the collection, sale or sharing of children’s personal information, in particular, with respect to geolocation data.

Implementation Guidance

The Act also establishes the California Children’s Data Protection Working Group, which will study and report to the legislature best practices for implementing the Act. The Working Group will consist of experts in children’s data privacy, physical health, mental health and well-being, computer science, and children’s rights. Among other topics, the Working Group is tasked with (1) identifying online services, products or features likely to be accessed by children; (2) ensuring that age-assurance methods used by covered businesses are risk-proportionate, privacy protective and minimally invasive; and (3) evaluating how the Working Group and the Department of Justice can leverage the expertise of the California Privacy Protection Agency in the long-term development of data privacy policies that affect the privacy, rights and safety of children online.

Enforcement

The California Attorney General is tasked with enforcing the Act, and may seek an injunction or civil penalty against any business that violates its provisions. Violators may be subject to a penalty of up to $2,500 per affected child for each negligent violation, and up to $7,500 per affected child for each intentional violation. The Act provides for a potential 90-day cure period, if a covered business substantially complies with the Act.