California’s Age-Appropriate Design Code Gets a Rewrite: New Privacy Rules for Users Under 18

California’s AB 2246 (Online Services, Products, or Features Likely to be Accessed by Children - OSPFLAC) establishes privacy and design requirements for covered businesses providing online services, products, or features likely to be accessed by children. It protects consumers under 18 through high privacy defaults, limits on personal information processing, age assurance, accessible notices and rights tools, and a duty to take reasonable steps to prevent specified harms.

The law repeals the California Age-Appropriate Design Code Act  (parts of which courts enjoined as likely unconstitutional) and replaces it with a new Title 1.81.47 of the Civil Code. Many privacy requirements remain, but the replacement removes the former law’s data protection impact assessment requirement and broad “best interests of children” exceptions. It also adds contract voidability and increases penalties.

Cal. Civ. Code §§ 1798.99.28–1798.99.34, as enacted by AB 2246, Stats. 2026, ch. 187.

PRACTICE TIP: A statement in the terms that the service is for adults does not resolve coverage. The law asks whether access by children is reasonably expected, using indicators that include actual audience evidence and product design.

Effective date: January 1, 2027.

• Approved September 10, 2026. Contains no urgency clause or separate delayed operative date. The date follows California’s ordinary constitutional rule for regular-session statutes. See Cal. Const., art. IV, § 8(c)(1).

Relationship to other laws:

• It incorporates the CCPA definitions unless it supplies a different definition. See, Cal Civ. Code § 1798.140
• It creates additional requirements for covered services and does not replace obligations independently applicable under the CCPA, COPPA, or other laws.
• Section 1798.99.33 expressly incorporates CCPA § 1798.145(c) exempting specified medical information, protected health information, and qualifying clinical-trial or biomedical-research information. It also exempts certain health care providers and HIPAA covered entities to the extent they maintain patient information in the manner specified by the statute.

Who Is Subject to OSPFLAC?

The principal obligations apply to a “business” as defined in CCPA providing an online service, product, or feature likely to be accessed by children. Cal. Civ. Code § 1798.140 (d).

• The definition covers an entity organized or operated for profit or the financial benefit of its owners that collects consumers’ personal information, or has it collected on its behalf; determines the purposes and means of processing, alone or jointly; does business in California; and meets at least one of three statutory thresholds.
• Other routes into the definition include certain commonly controlled entities sharing branding and consumers’ personal information, specified joint ventures or partnerships, and entities voluntarily certifying compliance.

See Cal. Civ. Code § 1798.140 (d).

The business need not be headquartered in California: doing business in the state and satisfying the applicable coverage conditions can bring an out-of-state business within scope.

What Is Regulated?

(1) Online Services, Products, and Features Likely to Be Accessed by Children

The law defines “likely to be accessed by children” by reference to whether it is reasonable to expect children to access the service, product, or feature, based on six indicators:

1. It is directed to children as defined by Children’s Online Privacy Protection Act (COPPA) (15 U.S.C. Sec. 6501 et seq.)
2. Competent and reliable audience evidence shows routine access by a significant number of children.
3. It includes advertisements marketed to children.
4. It is substantially similar to, or the same as, a service, product, or feature described in the second indicator.
5. Its design elements are known to interest children, including games, cartoons, music, and celebrities appealing to children.
6. Internal company research shows that a significant amount of its audience consists of children (the statute does not set a numerical cutoff for a “significant.”)

See Cal. Civ. Code § 1798.99.28(b)(3).

PRACTICE TIP: Assess individual features as well as the overall service. Document relevant audience research, advertising, and design choices rather than relying exclusively on the intended audience described in marketing materials.

"Children" means California residents who are 18 years-old or younger.

• AB 2246 generally applies the same substantive protections to all children under 18, although notices must suit the ages likely to access the service and age assurance must reflect relevant risks. By comparison, California’s Digital Age Assurance Act distinguishes four age brackets—under 13, 13–15, 16–17, and 18 or older—for communicating age signals, rather than prescribing a separate set of substantive protections for each bracket. Adam’s Law, which regulates companion chatbots, makes specific substantive distinctions: it provides greater flexibility for conversational memory for users aged 16 or 17 and requires parental controls allowing access to be disabled for children under 16. See Cal. Civ. Code §§ 1798.99.28(b)(1), 1798.99.29(a)(1), (3).
• The state's definition makes reference to "consumers" which is a term defined by CCPA to mean residents of California for tax purposes. See, Cal. Civ. Code § 1798.140(i).

The law incorporates the CCPA definition of personal information extends beyond names and contact details to information reasonably capable of being associated with, or reasonably linked to, a consumer or household. Depending on the circumstances, this includes identifiers, browsing activity, geolocation, and inferences. See Cal. Civ. Code § 1798.140(v). See also, When Everything is “Personal”: GDPR vs. CCPA.

(2) Exclusions and Exemptions

• “Online service, product, or feature” excludes broadband internet access service, telecommunications service as defined by federal law, and the delivery or use of a physical product. The physical-product exclusion should not automatically be treated as excluding every associated app or online feature. See Cal. Civ. Code § 1798.99.28(b)(4).
• Section 1798.99.33 also exempts the information and entities described in CCPA § 1798.145(c). That provision addresses specified medical information and protected health information, certain patient information maintained by health care providers or covered entities under the specified conditions, and information collected in qualifying clinical trials or biomedical research.

PRACTICE TIP: The law expressly incorporates § 1798.145(c), but not than the entire CCPA exemptions section. Do not assume that every exemption available under the CCPA also applies to this law. Even for health-related information, it will not automatically be exempt merely because it concerns health.

Individual Rights and Business Obligations

(1) Estimate Age or Apply Children’s Protections to Everyone

Covered businesses must estimate the age of child users with a reasonable level of certainty appropriate to the risks arising from their data management practices, or apply the privacy and data protections afforded to children to all consumers. See Cal. Civ. Code § 1798.99.29(a)(1).

• The age-estimation provision expressly refers to Civil Code § 1798.501(b), a provision of California’s Digital Age Assurance Act (DAA). Under that framework, covered application developers must request an age signal from an operating-system provider or covered application store when an application is downloaded onto and launched from a particular device. The signal identifies an age bracket—under 13, 13–15, 16–17, or 18 or older—rather than necessarily disclosing the user’s precise age or birth date.
• For websites associated with covered applications, the signal can also have consequences for website access. As amended by AB 1856, the DAA extends a developer’s deemed knowledge of the user’s age range to specified associated website contexts. These include a website through which the user creates an account for the platform accessed by the application, and website account creation or login from the device on which the application was downloaded and launched. The signal generally serves as the primary age indicator, unless internal clear and convincing information establishes a different age. See Cal. Civ. Code § 1798.501(d)(2)–(3), as amended by AB 1856.
• For standalone websites, the DAA does not establish a general requirement for browsers to transmit age signals to the sites users visit. A website covered by OSPFLAC must still estimate child users’ ages with reasonable certainty appropriate to the risks arising from its data practices, or extend children’s privacy and data protections to all consumers. Where no applicable app signal is available, the business must assess how to satisfy that obligation through another age-assurance approach or provide universal protections.
• Age assurance must be proportionate to the risks and data practices of the service, product, or feature. The law also restricts retention of information collected to estimate age or age range: businesses may not retain it for another purpose or longer than necessary to estimate age. See Cal. Civ. Code § 1798.99.29(b)(7).

PRACTICE TIP: Document the choice between age estimation and universal protections, including the risks supporting the assurance method and the treatment of age-estimation data. The law does not prescribe government identification. Applying protections universally does not eliminate duties independently imposed by the separate age-signal law.

(2) High Privacy by Default

All default privacy settings provided to children must offer a high level of privacy. A default is a preselected option adopted by the business. The new provision contains no exception allowing a lower default on the ground that it is in children’s best interests. See Cal. Civ. Code §§ 1798.99.28(b)(2), 1798.99.29(a)(2).

PRACTICE TIP: Test the initial experience before a child changes any settings. Optional controls cannot correct a default that fails the statutory standard.

(3) Clear Notices and Accessible Rights Tools

Privacy information, terms of service, policies, and community standards must be concise, prominent, and written in clear language suited to the ages of children likely to access the service.

Businesses must also provide prominent, accessible, and responsive tools helping children, or where applicable their parents or guardians, exercise privacy rights and report concerns. See Cal. Civ. Code § 1798.99.29(a)(3), (5).

PRACTICE TIP: Review the entire path from finding a notice or reporting tool to receiving a response. Publishing a simplified privacy notice alone does not satisfy the separate tools requirement.

(4) Visible Signals for Monitoring and Location Tracking

• Geolocation monitoring: If a service allows a parent, guardian, or another consumer to monitor a child’s online activity or track the child’s location, it must provide an obvious signal to the child when that monitoring or tracking occurs. See Cal. Civ. Code § 1798.99.29(a)(4).
• Geolocation collection: A separate rule requires an obvious sign throughout the collection of a child’s precise geolocation information. See Cal. Civ. Code § 1798.99.29(b)(5).

NOTE: “Precise geolocation” is defined by CCPA to mean any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations. See Cal. Civ. Code § 1798.140(w).

(5) Limits on Default Profiling

Profiling a child by default is prohibited unless the business can demonstrate appropriate safeguards protecting children and the profiling is necessary either:

• To provide the service, product, or feature with which the child is actively and knowingly engaged; or
• To enhance the child’s safety, privacy, or education.

Both safeguards and a qualifying necessity must exist. See Cal. Civ. Code § 1798.99.29(b)(1).

OSPFLAC separately defines profiling as automated processing using personal information to evaluate aspects of a natural person, including preferences, interests, behavior, health, economic circumstances, reliability, location, or movements. See Cal. Civ. Code § 1798.99.28(b)(5).

• Because it is separately defined, the law does not incorporate the CCPA definition of "profiling" under Cal. Civ. Code § 1798.140(z). That said, the definition of profiling closely tracks the CCPA definition, covering automated processing of personal information to evaluate aspects of a person, with the same illustrative list of characteristics. The principal textual difference is that it omits the CCPA’s express reference to further definition through regulations. Its standalone definition should therefore be applied directly, without importing regulatory qualifications from the CalPrivacy Rules.

PRACTICE TIP: A general claim that personalization benefits children does not establish necessity. Identify the specific function, the child’s engagement with it, the information processed, and the safeguards. A user’s decision to enable profiling also does not displace the chapter’s other restrictions. The definition does not depend on whether the business calls a system “AI” and does not incorporate CalPrivacy Rules on profiling.

(6) Data Minimization

Businesses must not collect, sell, share, or retain personal information unnecessary to provide the service, product, or feature with which a child is actively and knowingly engaged, subject to the expressly incorporated circumstances in CCPA § 1798.145(a)(1)(A)–(D). The exceptions preserve the ability to:

• Comply with laws, court orders, and subpoenas.
• Respond to government inquiries and investigations, including qualifying law-enforcement preservation directions for 90 days, with justified extensions. Information preserved after a deletion request generally cannot be used for unrelated purposes.
• Cooperate with law enforcement about reasonably suspected unlawful activity.
• Provide emergency government access where someone faces death or serious physical injury, subject to senior-officer approval, a lawful basis for access, and an agreement to seek a court order within three days and destroy the information if the order is denied. (Seeking contraception, pregnancy, or perinatal care—including abortion—does not itself qualify as such an emergency.)

See Cal. Civ. Code § 1798.99.29(b)(2).

PRACTICE TIP: Map each collection, disclosure, and retention practice to the feature the child actually uses or a specific exception. The former broad “best interests” justification is absent. Consent is not an exception to this restriction.

(7) Strict Purpose Limitation

When the end user is a child, personal information generally may be used only for a reason for which it was collected. The provision permits processing personal data necessary for service safety, integrity, or security; measurement, auditing, and system improvement; or compliance with the title. See Cal. Civ. Code § 1798.99.29(b)(3).

PRACTICE TIP: Evaluate the exceptions to purpose limitation separately from the minimization rule. An exception permitting a necessary improvement use does not automatically authorize additional collection, sale, sharing, or retention under a different provision.

(8) Precise Geolocation

Businesses must not collect, sell, or share children’s precise geolocation information by default unless collection is strictly necessary to provide the requested service, product, or feature, and then only for the limited time necessary to provide it. An obvious sign must remain visible throughout collection.

See (4) above for the definition of precise geolocation (which is imported from CCPA.)

See Cal. Civ. Code § 1798.99.29(b)(4)–(5).

PRACTICE TIP: A location permission at installation does not resolve whether collection remains strictly necessary during later use. Examine background collection, location-dependent features, and the duration of collection.

(9) Dark Patterns

The law prohibits using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide the service, product, or feature, or to forgo privacy protections. The incorporated CCPA definition addresses interfaces designed or manipulated with the substantial effect of subverting or impairing autonomy, decision-making, or choice. See Cal. Civ. Code §§ 1798.140(l), 1798.99.29(b)(6).

PRACTICE TIP: Review prompts, rewards, repeated requests, and the relative prominence of privacy choices. The question concerns how the interface influences the child’s decision, as well as the text of the choice.

(10) Reasonable Steps to Prevent Specified Harms

Covered businesses must take reasonable steps to prevent four categories of risk:

1. Reasonably foreseeable physical or financial harm.
2. Severe and reasonably foreseeable psychological or emotional harm to a reasonable child.
3. A highly offensive intrusion on privacy rights protected by state or federal law.
4. Adverse discrimination violating state or federal law.

The psychological and emotional category includes express severity, foreseeability, and reasonable-child qualifications. The privacy and discrimination categories connect the duty to rights protected by existing law. See Cal. Civ. Code § 1798.99.30(a).

The statute expressly states that this section does not impose a duty to monitor, screen, or remove third-party content, restrict lawful speech, or require particular ranking, recommendation, or editorial outcomes. Section 1798.99.29(c) separately states that its privacy rules do not require preventing children from accessing or viewing any piece or category of media.

PRACTICE TIP: Assess foreseeable risks from relevant data practices and design features and document reasonable prevention measures. The duty requires reasonable steps rather than guaranteeing that no child experiences harm.

Sanctions and Remedies

(1) Public Enforcement and Penalties

Violations can result in an injunction and civil penalties of up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation. Penalties are assessed and recovered only in a civil action brought by the Attorney General in the name of the people of California or by a public prosecutor. See Cal. Civ. Code § 1798.99.32(a).

PRACTICE TIP: The statutory unit combines affected children and violations. A negligent violation affecting 1,000 children could expose a business to up to $5 million for that violation. This illustrates the statutory maximum, not an automatic assessment.

The Attorney General may adopt regulations clarifying the chapter and solicit broad public participation. See Cal. Civ. Code § 1798.99.32(d).

The law does not provide for a notice-and-cure period.

(2) No Private Right of Action

The chapter expressly states that nothing in it may serve as the basis for a private right of action under the chapter or another law. It therefore does not authorize private damages claims for its violations. See Cal. Civ. Code § 1798.99.32(c).

(3) Contract Provisions Voidable at the Child’s Election

Any provision of a contract entered into by a child or the child’s parent or guardian is voidable at the child’s election if the contract resulted from a design feature of a covered online service, product, or feature. The provision expressly includes terms-of-service agreements. See Cal. Civ. Code § 1798.99.31.

• “Voidable” means subject to avoidance at the child’s election; it does not mean every covered contract term is automatically invalid. The statutory condition connects entry into the contract to a design feature and is not expressly limited to unlawful dark patterns.

PRACTICE TIP: Review subscription, purchase, and terms-acceptance flows, including those completed by parents. The statute does not explain the procedure for exercising voidability or how it interacts with the private-action bar. Those questions should not be resolved by assuming a private damages remedy that the chapter expressly disclaims.

How Does AB 2246 Change the Former Design Code?

The replacement preserves the under-18 scope, the six audience indicators, and many duties concerning defaults, notices, monitoring signals, profiling, minimization, geolocation, and age-estimation data. Its principal changes include:

• Removing the former law’s DPIA and associated reporting framework.
• Removing broad “best interests of children” exceptions and supplying more specific conditions for certain practices.
• Replacing the former materially detrimental data-use prohibition with a reasonable-steps duty tied to four specified harms.
• Narrowing the dark-pattern provision to privacy-related conduct rather than retaining the former general material-detriment language.
• Adding contract voidability, increasing penalties, and allowing enforcement by public prosecutors.

The litigation background helps explain these changes. In March 2026, the Ninth Circuit affirmed preliminary relief against the former law’s challenged data-use and dark-pattern provisions on vagueness grounds, while vacating other parts of the injunction and remanding. Earlier litigation had addressed the DPIA requirement. Those decisions concerned the former statute; they do not establish the constitutionality of AB 2246.

AB 2246 also includes an express severability clause: invalidity of one provision or application does not defeat other provisions or applications capable of operating independently. See Cal. Civ. Code § 1798.99.34.

PRACTICE TIP: Review existing design-code work against the replacement text. A former assessment may provide useful evidence, but AB 2246 does not require that particular report. Conversely, removing its DPIA requirement does not eliminate assessment duties arising independently under the CCPA or another applicable law.

Additional Resources

Legislation and Official Materials

• Online Services, Products, or Features Likely to Be Accessed by Children — The replacement framework enacted through AB 2246, Stats. 2026, ch. 187, including privacy obligations, contract voidability, and enforcement.
• Former California Age-Appropriate Design Code Act — The original law enacted through AB 2273, Stats. 2022, ch. 320, useful for comparing the former requirements with the replacement.
• California Consumer Privacy Act—Statutory Text — Official statutory compilation from the California Privacy Protection Agency. Particularly relevant are § 1798.140, supplying incorporated definitions, and § 1798.145, addressing exemptions and specified legal-compliance activities.
• Digital Age Assurance Act—Age-Signal Requirements and AB 1856 Amendments — Read together to understand developer obligations, associated website access, and the relocation of developer duties to § 1798.501(d).
• CCPA Monetary Threshold Adjustments — Official inflation adjustments, including the revenue threshold relevant to determining whether an entity qualifies as a CCPA “business.”

Case Law

These decisions concern the former Design Code, rather than establishing the constitutionality of its replacement:

• NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024) — Addresses the former DPIA requirement, First Amendment concerns, and related severability issues.
• NetChoice, LLC v. Bonta, No. 25-2366 (9th Cir. Mar. 12, 2026) — Addresses coverage, age estimation, challenged data-use and dark-pattern restrictions, and severability.

Related Reading in The de la Torre Review

• California’s Digital Age Assurance Act: Moving Age Verification to the Device — Explains how age brackets are communicated through operating systems and application stores, and how developers use those signals to comply with age-dependent laws.
• California’s Adam’s Law: Building Child Safety Into AI Companion Chatbots — Examines companion-chatbot protections, including the distinctions between younger children and users aged 16 or 17.
• When Everything is “Personal”: GDPR vs. CCPA — Explores the broad definitions of personal data and personal information, including identifiers, household information, and inferences.
• CalOPPA Explained: California’s Online Privacy Policy Law — Explains the separate obligation to publish a privacy policy, providing context for the replacement Design Code’s additional requirements for notices suited to children.