Privacy Law Library

California Age-Appropriate Design Code Act (AB 2273, 2022)

CAADCA

Children

Required online services likely to be used by children to assess risks to children, default to high privacy, estimate users' ages, and avoid harmful data uses, profiling, precise geolocation collection, and dark patterns. It has never been fully enforceable: NetChoice v. Bonta produced preliminary injunctions in 2023 and 2025, and on March 12, 2026 the Ninth Circuit (No. 25-2366) narrowed the injunction, leaving the impact-assessment duties, the data-use restrictions, and the dark-patterns ban enjoined while vacating the injunction as to coverage and age estimation and remanding. AB 2246 (2026) repeals and replaces this title effective January 1, 2027.

Where
California
Citation
Cal. Civ. Code 1798.99.28-1798.99.40 (Title 1.81.47, as enacted by AB 2273)
Status
Blocked by a court
In force since
2024-07-01
Last amended
2025-01-01
Enforced by
California Attorney General
People can sue
No
Penalties
Civil penalty up to $2,500 per affected child per negligent violation and $7,500 per affected child per intentional violation, AG action only; 90-day notice and cure for businesses substantially complying with the assessment duties (1798.99.35).
Applies to
  • CCPA-covered businesses providing an online service, product, or feature likely to be accessed by children under 18

What a privacy notice must say

  • Provide privacy information and terms in clear, age-appropriate language, and give an obvious signal when a child is being monitored or tracked.Cal. Civ. Code 1798.99.31(a)(7)-(8)

Practices it requires

  • Estimate child users' ages with reasonable certainty, or apply child protections to all users.Cal. Civ. Code 1798.99.31(a)(5)
  • Configure children's default privacy settings to a high level of privacy.Cal. Civ. Code 1798.99.31(a)(6)
  • Do not use children's data in materially detrimental ways, profile by default, collect or keep unnecessary data, or use dark patterns (enjoined).Cal. Civ. Code 1798.99.31(b)(1)-(4), (7)
  • Do not collect children's precise geolocation by default unless strictly necessary, and signal when it is being collected.Cal. Civ. Code 1798.99.31(b)(5)-(6)

Other duties

  • Complete a Data Protection Impact Assessment for services likely to be accessed by children and give it to the Attorney General on request (enjoined).Cal. Civ. Code 1798.99.31(a)(1)-(4)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Exact scope of the current injunction comes from a law-firm summary of the March 12, 2026 opinion (Cooley, Mar. 30, 2026); the opinion itself and any later district court order on remand were not read. Treat which subdivisions are enforceable today as needing confirmation from the N.D. Cal. docket (NetChoice v. Bonta, No. 5:22-cv-08861). | last_amended reflects SB 1525 (Stats. 2024, Ch. 80) amending 1798.99.31; its effective date was not confirmed.

Research reference, not legal advice.