language: en · last checked: 2026-10-26

AB 2246 (online services likely to be accessed by children) — chaptered text

AB 2246 in full as chaptered: the Legislative Counsel's Digest, the repeal of the California Age-Appropriate Design Code Act (Title 1.81.47) and the new Title 1.81.47 put in its place.

Legislative Counsel's Digest

Verbatim from the Legislative Counsel's Digest to the chaptered bill (California Legislative Information; retrieved through the Legislature's pubinfo bulk export, see Meta). The digest is the Legislative Counsel's summary, not the statute.

Existing law, the California Age-Appropriate Design Code Act, requires a business that provides an online service, product, or feature likely to be accessed by children to comply with certain requirements, including, among other things, prohibiting the business from collecting, selling, sharing, or retaining any personal information that is not necessary to provide the online service, product, or feature, except as specified. Existing law imposes specified civil penalties upon a business that violates these provisions.

This bill would repeal the above-described act and would instead impose similar provisions without the above-referenced exceptions and would impose civil penalties for a violation of these provisions. The bill would require a business that provides an online service, product, or feature likely to be accessed by children to take reasonable steps to prevent specified risks of harm to children. The bill would authorize a child to void any provision of a contract that was entered into by the child or their parent or guardian as a result of a design feature of the online service, product, or feature. The bill would authorize the Attorney General or a public prosecutor to bring a civil action for a violation of these provisions, as specified.

Bill text

Verbatim from the chaptered bill — Statutes of 2026, Chapter 187, approved by the Governor 2026-09-10 and filed with the Secretary of State 2026-09-10 (California Legislative Information; see Meta).

An act to repeal and add Title 1.81.47 (commencing with Section 1798.99.28) of Part 4 of Division 3 of the Civil Code, relating to business.

The people of the State of California do enact as follows:

SECTION 1

Title 1.81.47 (commencing with Section 1798.99.28) of Part 4 of Division 3 of the Civil Code is repealed.

SEC. 2

Title 1.81.47 (commencing with Section 1798.99.28) is added to Part 4 of Division 3 of the Civil Code, to read:

Online Services, Products, or Features Likely to be Accessed by Children

Civ. Code §1798.99.28

(a) For purposes of this chapter, the definitions in Section 1798.140 shall apply unless otherwise specified in this chapter.

(b) For the purposes of this chapter:

(1) “Child” or “children,” unless otherwise specified, means a consumer or consumers who are under 18 years of age.
(2) “Default” means a preselected option adopted by the business for the online service, product, or feature.
(3) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
- (A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
- (B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
- (C) An online service, product, or feature with advertisements marketed to children.
- (D) An online service, product, or feature that is substantially similar to or the same as an online service, product, or feature subject to subparagraph (B).
- (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
- (F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.
(4) “Online service, product, or feature” does not mean any of the following:
- (A) A broadband internet access service, as defined in Section 3100.
- (B) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.
- (C) The delivery or use of a physical product.
(5) “Profiling” means any form of automated processing of personal information that uses personal information to evaluate certain aspects relating to a natural person, including analyzing or predicting aspects concerning a natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

Civ. Code §1798.99.29

(a) A business that provides an online service, product, or feature likely to be accessed by children shall take all of the following actions:

(1) Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business pursuant to subdivision (b) of Section 1798.501 of the Civil Code or apply the privacy and data protections afforded to children to all consumers.
(2) Configure all default privacy settings provided to children by the online service, product, or feature to settings that offer a high level of privacy.
(3) Provide any privacy information, terms of service, policies, and community standards concisely, prominently, and using clear language suited to the age of children likely to access that online service, product, or feature.
(4) If the online service, product, or feature allows the child’s parent, guardian, or any other consumer to monitor the child’s online activity or track the child’s location, provide an obvious signal to the child when the child is being monitored or tracked.
(5) Provide prominent, accessible, and responsive tools to help children, or if applicable their parents or guardians, exercise their privacy rights and report concerns.

(b) A business that provides an online service, product, or feature likely to be accessed by children shall not take any of the following actions:

(1) Profile a child by default unless the both of the following criteria are met:
- (A) The business can demonstrate it has appropriate safeguards in place to protect children.
- (B) Either of the following is true:
  - (i) Profiling is necessary to provide the online service, product, or feature with which the child is actively and knowingly engaged.
  - (ii) The profiling is necessary to enhance the safety, privacy, or education of a child.
(2) Collect, sell, share, or retain any personal information that is not necessary to provide an online service, product, or feature with which a child is actively and knowingly engaged, or as described in subparagraphs (A) to (D), inclusive, of paragraph (1) of subdivision (a) of Section 1798.145.
(3)
- (A) If the end user is a child, use personal information for any reason other than a reason for which that personal information was collected.
- (B) This paragraph does not prohibit a business from processing personal data necessary to ensure the safety, integrity, or security of the service, for measurement, auditing, and system improvement, or to comply with this title.
(4) Collect, sell, or share any precise geolocation information of children by default unless the collection of that precise geolocation information is strictly necessary for the business to provide the service, product, or feature requested and then only for the limited time that the collection of precise geolocation information is necessary to provide the service, product, or feature.
(5) Collect any precise geolocation information of a child without providing an obvious sign to the child for the duration of that collection that precise geolocation information is being collected.
(6) Use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections.
(7) Retain any personal information collected to estimate age or age range for any other purpose or retain that personal information longer than necessary to estimate age. Age assurance shall be proportionate to the risks and data practice of an online service, product, or feature.

(c) Nothing in this section shall be construed to require a business to prevent or preclude a child from accessing or viewing any piece of media or category of media.

Civ. Code §1798.99.30

(a) A business that provides an online service, product, or feature likely to be accessed by children shall take reasonable steps to prevent the following risks of harm to children:

(1) Reasonably foreseeable physical or financial harm.
(2) Severe and reasonably foreseeable psychological or emotional harm to a reasonable child.
(3) A highly offensive intrusion on privacy rights protected by state or federal law.
(4) Adverse discrimination in violate of state or federal law.

(b) Nothing in this section shall be construed to impose a duty to monitor, screen, or remove third-party content; to restrict lawful speech; or to require any specific content ranking, recommendation, or editorial outcomes.

Civ. Code §1798.99.31

Any provision of a contract entered into by a child or a child’s parent or guardian is voidable at the child’s election if the contract was entered into as a result of a design feature of an online service, product, or feature likely to be accessed by children, including, but not limited to, the provisions of a contract or other agreement governing the terms of service for that online service, product, or feature.

Civ. Code §1798.99.32

(a) Any business that violates this chapter shall be subject to an injunction and liable for a civil penalty of not more than five thousand dollars ($5,000) per affected child for each negligent violation or not more than fifteen thousand dollars ($15,000) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought by either of the following:

(1) In the name of the people of the State of California by the Attorney General.
(2) A public prosecutor.

(b) Any penalties, fees, and expenses recovered in an action brought by the Attorney General under this chapter shall be deposited in the Consumer Privacy Fund, created within the General Fund pursuant to subdivision (a) of Section 1798.160, with the intent that they be used to fully offset costs incurred by the Attorney General in connection with this chapter.

(c) Nothing in this chapter shall be interpreted to serve as the basis for a private right of action under this chapter or any other law.

(d) The Attorney General may solicit broad public participation and adopt regulations to clarify the requirements of this chapter.

Civ. Code §1798.99.33

This chapter does not apply to the information or entities described in subdivision (c) of Section 1798.145.

Civ. Code §1798.99.34

The provisions of this title are severable. If any provision of this title or its application is held invalid, that invalidity shall not affect other provisions or applications that can be given effect without the invalid provision or application.