Online services, products, or features likely to be accessed by children (AB 2246, 2026 replacement of the Age-Appropriate Design Code)
AB 2246 Children's Online Design Law
Children
Signed September 10, 2026, AB 2246 repeals the 2022 Age-Appropriate Design Code and re-enacts a narrower version: age estimation (tied to the Digital Age Assurance Act signals) or child protections for all users, high-privacy defaults, limits on profiling, data collection, and precise geolocation, and a new duty to take reasonable steps to prevent listed harms to children. It drops the data protection impact assessment and 'best interests' tests that courts had enjoined, and it lets a child void contract terms obtained through a design feature.
- Where
- California
- Citation
- Cal. Civ. Code 1798.99.28-1798.99.34 (Title 1.81.47, as added by Stats. 2026, Ch. 187)
- Status
- Enacted, not yet in force
- In force since
- 2027-01-01
- Enforced by
- California Attorney General and public prosecutors
- People can sue
- No
- Penalties
- Civil penalty up to $5,000 per affected child per negligent violation and $15,000 per affected child per intentional violation, in actions by the AG or a public prosecutor (1798.99.32).
- Applies to
- Businesses (CCPA definitions) providing an online service, product, or feature likely to be accessed by children under 18, judged by listed indicators such as COPPA child-directed status, audience data, and child-oriented design (1798.99.28)
- Excludes broadband, telecommunications services, and delivery of physical products
Rights it gives people
- A child may void contract terms entered into because of a design feature of the service.Cal. Civ. Code 1798.99.31 · From 2027-01-01
Practices it requires
- Estimate child users' age with reasonable certainty (may rely on Digital Age Assurance Act signals) or apply child protections to all consumers.Cal. Civ. Code 1798.99.29(a)(1) · From 2027-01-01
- Set children's default privacy settings to a high level of privacy; provide clear, age-appropriate privacy information and privacy tools; signal to the child when monitored or tracked.Cal. Civ. Code 1798.99.29(a)(2)-(5) · From 2027-01-01
- Do not profile a child by default unless safeguards exist and profiling is necessary for the service or for the child's safety, privacy, or education.Cal. Civ. Code 1798.99.29(b)(1) · From 2027-01-01
- Do not collect, sell, share, or retain unnecessary personal information of children, or reuse it for other purposes.Cal. Civ. Code 1798.99.29(b)(2)-(3) · From 2027-01-01
- Do not collect children's precise geolocation by default unless strictly necessary, and show an obvious sign while collecting it.Cal. Civ. Code 1798.99.29(b)(4)-(5) · From 2027-01-01
- Do not use dark patterns to get children to provide more data or give up privacy protections; do not reuse or over-retain age-estimation data.Cal. Civ. Code 1798.99.29(b)(6)-(7) · From 2027-01-01
- Take reasonable steps to prevent foreseeable physical or financial harm, severe psychological harm, highly offensive privacy intrusions, and unlawful discrimination against children.Cal. Civ. Code 1798.99.30(a) · From 2027-01-01
Sources
- Official text
- AB 2246 (2025-26) bill history, Chapter 187, Statutes of 2026
- AB 2246 chaptered text
- Governor's press release, Sept. 10, 2026
Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.
Unverified: Effective date assumed to be January 1, 2027 under the default rule for 2026 regular-session statutes; the bill text shows no urgency clause or separate operative date.
Research reference, not legal advice.