A Closer Look at the California Age-Appropriate Design Code Act by Tom Kemp Golden Data

Table Of Content

• New California Privacy Protection Agency law enforcement powers
• Governor Newsom Signs First-in-Nation Bill Protecting Children’s Online Data and Privacy
• “Likely to be accessed by children.”
• Obligations for Organizations Under the California Age-Appropriate Design Code Act
• American Data Privacy and Protection Act (ADPPA): Explained

The bill, which was introduced in February 2022, is a major indication that lawmakers are finally ready to ask the tech industry to consider the safety of users. The Attorney General would be permitted to seek a civil lawsuit against any company that violates its provisions. The proposed law would subject violators to civil penalties of up to $2,500 per impacted kid for each negligent violation and up to $7,500 for each intentional violation. Give any privacy information, terms of service, policies, and community standards in a clear, concise manner that is visible to children of the age group most likely to access it. Document any risk that the company's data management methods provide to children that could be materially harmful, as determined by the Data Protection Impact Assessment. By shifting the monitoring and enforcement power of published policies from online businesses to the California Attorney General, NetChoice claims, the CAADCA in effect restricts the businesses’ editorial discretion protected by Section 230.

New California Privacy Protection Agency law enforcement powers

Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is  intended to be  a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us. The California Attorney General is tasked with enforcing the Act, and may seek an injunction or civil penalty against any business that violates its provisions.

Governor Newsom Signs First-in-Nation Bill Protecting Children’s Online Data and Privacy

If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor. The Data Protection Impact Assessment should identify the objective of the online service, product, or feature, how it uses children's personal information, and the risks of material harm to children that result from the business's data management practices. The bill, which aims to regulate the collection, processing, storage, and transfer of children's data, is based on the Age Appropriate Design Code (AADC) of the United Kingdom. The California legislature considers the bill necessary as young people increasingly use digital services for entertainment, education, communication, and other objectives and are subject to targeted online advertisements. District Judge Beth Labson Freeman granted a preliminary injunction against the enforcement of the California Age-Appropriate Design Code Act (CAADCA or “the Act”).

“Likely to be accessed by children.”

The goal of AB 2273 is consistent with the intent of Proposition 24 (CPRA), and in fact one of the major points of emphasis in the campaign for Proposition 24 was that it further enhanced the California Consumer Privacy Act (CCPA) by adding additional capabilities to safeguard our children’s safety. Proposition 24 also required opt-in consent for the sale of personal information from consumers under 16. "As we approach the conclusion of another U.S. Congressional session with no updates to children’s privacy or safety, states have made it clear they will fill the void." Sanchez said. "This bill takes a novel approach in responding to parents’ and lawmakers’ very real concerns that young people are not sufficiently protected online. It’s the first child-centered design bill we’ve seen in the U.S. If enacted, many expect that we will see other variations introduced by other state legislatures next year." Data minimization requirements, prohibitions on geolocation data collection, use and sale, and a ban on "dark patterns" that promote the submission of unnecessary personal data are a few of the shared topics.

Obligations for Organizations Under the California Age-Appropriate Design Code Act

Under the CAADCA, covered businesses need to configure all default privacy settings to a high level of privacy if their published content is “likely to be accessed by children.” NetChoice asserts the definition of “likely to be accessed by children” is vague and overbroad. It would impose undue burden on a sweeping majority of online businesses, including, for example, all major news outlets and all sports league websites. Additionally, the ADCA would require covered entities to “establish the age of consumers with a reasonable level of certainty” appropriate to the risks or to apply the highest protections to all consumers. Age assurance and verification have been ongoing concerns as companies struggle with practical implementation. Some online services already engage in some form of age identification or inference, but some advocates have critiqued COPPA’s “actual knowledge” standard, arguing that it incentivizes websites for a general audience to simply not ask users’ ages.

American Data Privacy and Protection Act (ADPPA): Explained

To access the Youth & Ed team’s child and student privacy resources, visit and follow the team on Twitter at @SPrivacyCompass. FPF’s youth and education privacy team has closely tracked the progress of the California AADC; catch up on previous blog posts from June 28 and a September 1 update, and read our statement on the final bill here. Gain exclusive insights about how privacy affects business in Australia and Aotearoa New Zealand. Leaders from across the Canadian privacy field deliver insights, discuss trends, offer predictions and share best practices. The IAPP's EU General Data Protection Regulation page collects the guidance, analysis, tools and resources you need to make sure you're meeting your obligations. On this topic page, you can find the IAPP’s collection of coverage, analysis and resources covering AI connections to the privacy space.

Amended KOSA Places Lina Khan in Charge of Deciding What’s Best for Our Kids Online - R Street

Amended KOSA Places Lina Khan in Charge of Deciding What’s Best for Our Kids Online.

Posted: Wed, 17 Apr 2024 07:00:00 GMT [source]

A Better World Online is Possible

The law was modeled after the United Kingdom’s Age Appropriate Design Code, which similarly requires that websites likely to be accessed by children provide privacy protections by default. The Legislature unanimously passed the law, finding that more needs to be done to create a safer online space for children to learn, explore, and play. Despite businesses’ awareness that children use their services, businesses currently design their online services to include features that may be harmful to children, including manipulative techniques to prod them to spend hours on end online or provide personal information beyond what is expected or necessary. NetChoice states that CAADCA is preempted by COPPA because the Act is inconsistent with the scope and substantive obligations under COPPA. On one hand, COPPA regulates online services directed to children under the age of 13, whereas CAADCA applies to any service, product or feature that is likely accessed by children under the age of 18. On the other hand, in contrast to COPPA’s “notice and consent” regime for children’s privacy, CAADCA imposes obligations such as creating DPIAs, configuring a high level of default privacy settings or estimating user age, all of which are not covered by COPPA.

1 Child or Children

Inspired by the success of the AADC model, Kids Codes have been introduced in many other states in the U.S. By Adi Robertson, a senior tech and policy editor focused on VR, online platforms, and free expression. The Act also places restrictions on the profiling of children, use of dark patterns, and the collection, sale or sharing of children’s personal information, in particular, with respect to geolocation data.

The protections under the Act extend to all “children,” defined as consumers under the age of 18, and in respect of online products and services (i) specifically directed at children and (ii) that are “likely to be accessed” by children. The ADCA would task the California Privacy Protection Agency (CPPA) with establishing the California Children’s Data Protection Taskforce (the “Taskforce”) and publishing privacy information, policies, and standards. The CPPA is an agency established through the CPRA for the purpose of implementing and enforcing the law. Under the ADCA, the Taskforce would be responsible for adopting regulations by April 1, 2024 and providing compliance guidance. Members would consist of “Californians with expertise in the areas of privacy, physical health, mental health, and well-being, technology, and children’s rights.” Companies would have 3 months to comply with regulations produced by the taskforce prior to enforcement by the CPPA.

Securiti can assist you in complying with California Age-Appropriate Design Code Act and other privacy and security standards worldwide. Unless otherwise specified, a “child” or “children” means a consumer or consumers under 18 years of age. In a separate lawsuit, NetChoice challenged the constitutionality of social media laws deplatforming political candidates based on “viewpoint” in Texas and Florida, arguing both laws violated the First Amendment.

• Has design elements that are known to be of interest to children (e.g., games, cartoons, music, and celebrities who appeal to children). In support of the California Kids Code, the GoodforMEdia team provided testimony to the California State Assembly about how to improve online experiences for young people. Less recently, the Supreme Court intervened to block a Texas ban on much online moderation, setting up a battle that could determine how much control states have over the internet. The Biden administration urged the Supreme Court to strike down the core provisions of that law and a similar one in Florida last month. At Securiti, our mission is to enable organizations to safely harness the incredible power of Data & AI.