Privacy Map

California. Children's privacy. Act

CAADCACalifornia Age-Appropriate Design Code Act (AB 2273; Cal. Civ. Code § 1798.99.28 et seq.)

Partially in force
Partly verifiedMedium confidence. District court remand ongoing; check current injunction scope.

§1Summary

Synopsis

Requires online services likely to be accessed by under-18s to estimate users' age or apply child protections to everyone, set high privacy defaults and provide child-appropriate disclosures. Several provisions remain blocked on First Amendment grounds.

Key themes
  • likely to be accessed by children
  • age estimation
  • high privacy defaults
  • DPIA (enjoined)
  • dark patterns (enjoined)
Unique features

Modelled on the UK Age Appropriate Design Code; litigation has split it into enforceable and enjoined parts.

SaaS relevance

Consumer SaaS likely to be used by teens must implement age estimation or default high-privacy settings.

§2Obligations

Extraterritorial
Yes
Breach notification
None
DPO
No
Cross-border transfers
None
Maximum penalty
Up to $2,500 per affected child (negligent); $7,500 (intentional)

§3Dates

Key dates
  • Adopted
  • In force
  • Enjoined before operative date; Ninth Circuit (2024) upheld injunction of DPIA provisions; Ninth Circuit 2026-03-12 narrowed injunction, allowing age estimation and default-privacy provisions to take effect pending remand.

§4Text and authority

Text
Authority
California Attorney General

§5Where it applies

Domestic law of
California

§6Sources and verification

Verification

Medium confidence.

Partly verifiedMedium confidence. District court remand ongoing; check current injunction scope.