California

Researchedlast verified 2026-07-04

Has regulations

Three tracked regulations: ca-aadc (Age-Appropriate Design Code / AB 2273), partially in force after the Ninth Circuit narrowed the injunction 2026-03-12, with the DPIA, dark-patterns, and data-use provisions still enjoined; ca-ab1043 (Digital Age Assurance Act), signed 2025-10-13, operative 2027-01-01; and ca-sb976 (Protecting Our Kids from Social Media Addiction Act), signed 2024-09-20, core provisions effective 2025-01-01 and in force after the Ninth Circuit on 2025-09-09 upheld the addictive-feed and default-private-mode provisions, with the notification-restriction and engagement-metric ('like'-count) provisions enjoined.

Sources: California Legislative Information: AB 2273 (Age-Appropriate Design Code Act) · California Legislative Information: AB 1043 (Digital Age Assurance Act)

California Age-Appropriate Design Code Act (AB 2273) ↗

In forceResearchedlast verified 2026-07-04

Online service accessed by minors

Partially in force. After years fully enjoined, the Ninth Circuit narrowed the injunction on 2026-03-12 (NetChoice v. Bonta, No. 25-2366): the age-estimation and default-high-privacy duties (and related transparency/geolocation/tools provisions) are now enforceable, while the DPIA requirement, the dark-patterns prohibition, and the data-use/profiling restrictions remain enjoined. Case remanded on age estimation and severability.

Regulation-level `in_force` is the honest summary of a split ruling, not a claim that the whole Act is enforceable: the age-estimation and default-high-privacy duties (plus related transparency/geolocation/tools provisions) are enforceable, while the DPIA, dark-patterns, and data-use/profiling obligations carry `enforcement_override: enjoined`. Confidence is `researched` (corroborated by the 2026-03-12 Ninth Circuit opinion and multiple law-firm analyses with section-level detail), but the posture may shift: the case is on remand as to age estimation and severability. Section pins are from a law-firm reading of the opinion, not yet from a line-by-line pass of the codified text.

Scope

AADC-style duty holder: a 'business' (as defined by the CCPA) that provides an online service, product, or feature 'likely to be accessed by children' (under 18), judged by a six-indicator test including whether the service is directed to children, is routinely accessed by a significant number of children, or has design elements known to be of interest to children.

Coverage conditions

Applies only to a 'business' as defined by the CCPA, so the CCPA's business thresholds gate coverage.

Penalties

Model: Per violation
Detail: Civil penalty up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation; injunctive relief available.
Enforcer: California Attorney General
Private right of action: No

Key dates

Signed: 2022-09-15
Effective: 2024-07-01

Obligations (5)

Age verification / estimationUnder 1313–1516–17

Plain:Estimate the age of child users with a reasonable level of certainty appropriate to the risks, or apply the child-protective settings to all users.

Statute’s own ages: Protects all consumers under 18; no narrower statutory subdivision (broader than COPPA's under-13).

Cal. Civ. Code § 1798.99.31(a)(5)

Default-high privacy for minorsUnder 1313–1516–17

Plain:Set all default privacy settings offered to children to the highest level of privacy, unless a compelling reason supports a different setting in the child's best interests.

Statute’s own ages: Applies to users under 18.

Cal. Civ. Code § 1798.99.31(a)(6)

DPIA / risk assessmentUnder 1313–1516–17

Plain:Complete a Data Protection Impact Assessment before offering a new online service, product, or feature likely to be accessed by children, and address identified risks.

Statute’s own ages: Applies to services likely to be accessed by users under 18.

EnjoinedThis provision differs from the law’s overall status: The DPIA requirement remains enjoined: the Ninth Circuit affirmed the injunction against it (first opinion 2024-08-16, unchanged 2026-03-12), so it is currently unenforceable even though the regulation-level status is partially in force.

Cal. Civ. Code § 1798.99.31(a)(1)-(a)(4)

Design / dark-pattern restrictionsUnder 1313–1516–17

Plain:Do not use dark patterns to lead or encourage children to provide unnecessary personal information or to take actions against their well-being.

Statute’s own ages: Applies to users under 18.

EnjoinedThis provision differs from the law’s overall status: The dark-patterns prohibition remains enjoined: the Ninth Circuit held it likely unconstitutionally vague (2026-03-12), so it is currently unenforceable while the regulation as a whole is partially in force.

Cal. Civ. Code § 1798.99.31(b)(7)

Minor data protectionUnder 1313–1516–17

Plain:Do not use a child's personal information in ways materially detrimental to the child's well-being, profile a child by default, or collect/share/retain more of a child's data than necessary.

Statute’s own ages: Applies to users under 18.

EnjoinedThis provision differs from the law’s overall status: These data-use, default-profiling, and collection/retention restrictions remain enjoined: the Ninth Circuit affirmed the injunction on vagueness grounds (2026-03-12), so they are currently unenforceable while other duties in this Act are live.

Cal. Civ. Code § 1798.99.31(b)(1)-(b)(4)

Litigation history

2022-12
NetChoice filed suit challenging the CAADCA on First Amendment grounds (NetChoice v. Bonta, N.D. Cal.)
→ Enforcement challenged; law not yet operative (operative date was 2024-07-01) source ↗
2023-09-18
District court (N.D. Cal.) granted a preliminary injunction blocking the entire Act
→ Unenforceable statewide source ↗
2024-08-16
Ninth Circuit (first opinion) affirmed the injunction as to the DPIA requirement and vacated/remanded as to the remaining provisions
→ DPIA provisions remained enjoined; the remainder was sent back for narrower analysis source ↗
2026-03-12
Ninth Circuit (second opinion, No. 25-2366) narrowed the injunction: vacated it as to age estimation, the coverage definition, default-high-privacy settings, geolocation, transparency, and privacy tools; affirmed it as to the DPIA requirement, dark-patterns prohibition, and data-use/profiling restrictions; remanded on age estimation and severability
→ Age-estimation and default-high-privacy duties (and related provisions) enforceable; DPIA, dark-patterns, and data-use/profiling provisions remain enjoined source ↗

Cross-state comparisons

similarca-ab1043 (California): Same jurisdiction and shared goal (protecting minors online), but different mechanisms: the AADC imposes design and age-estimation duties on the service itself, while AB 1043 supplies a device/OS-level age-bracket signal that a service could consume to satisfy age-estimation-style needs.
similarmd-kids-code (Maryland): Maryland's Kids Code is modeled on this Act (near-identical best-interests/design duties), but the litigation fates diverged: Maryland's has never been enjoined and is fully in force, while the California original is only partially enforceable after NetChoice v. Bonta. A shared implementation covers both, but the enforceable scope differs by state.

Sources: California Legislative Information: AB 2273 (2021-2022), Age-Appropriate Design Code Act · NetChoice v. Bonta, No. 25-2366 (9th Cir. Mar. 12, 2026): opinion · Holland & Knight: Ninth Circuit Issues Mixed Ruling on California AADC · Loeb & Loeb: Ninth Circuit Rules Parts of California AADC Are Effective and Enforceable (section-level breakdown)

Digital Age Assurance Act (AB 1043) ↗

DelayedResearchedlast verified 2026-07-04

Operating system providerApp developer

Signed 2025-10-13; operative 2027-01-01 (Cal. Civ. Code § 1798.505). No known legal challenge as of 2026-07-04.

Status is `delayed` (operative 2027-01-01, no litigation known as of 2026-07-04). Age brackets map cleanly to the canonical bands: the statute's '13 to under 16' equals 13_15 and '16 to under 18' equals 16_17. Enforcement is AG-exclusive with no private right of action (Cal. Civ. Code § 1798.503). Developer/OS section pins are approximate within the confirmed § 1798.500-1798.505 range and need a line-by-line pass against the codified text.

Scope

Duties are layered by role: operating-system providers must collect the primary user's birth date/age at setup and expose a real-time age-bracket signal; developers that make an application available must request that signal at download and launch and treat it as the primary indicator of the user's age range absent clear and convincing contrary information.

The Act also references the app store as a source of the age-bracket signal and includes a 'covered app store' in the good-faith liability safe harbor (Cal. Civ. Code § 1798.503); the Act ties a developer's use of the signal to compliance with other applicable law (e.g., the CCPA's minor opt-out, Civ. Code § 1798.120).

Penalties

Model: Per violation
Detail: Civil penalty up to $2,500 per affected child for each negligent violation and up to $7,500 per affected child for each intentional violation; injunctive relief available. An operating-system provider or covered app store that makes a good-faith effort to comply is not liable for an erroneous signal or for a developer's downstream conduct (Cal. Civ. Code § 1798.503).
Enforcer: California Attorney General (exclusive; suit brought in the name of the People)
Private right of action: No

Key dates

Signed: 2025-10-13
Effective: 2027-01-01

Obligations (3)

Age rating & store signalsUnder 1313–1516–17effective 2027-01-01

Plain:Request the operating system's or app store's age-bracket signal when the app is downloaded and when it is launched, and treat that signal as the primary indicator of the user's age range unless clear and convincing information shows otherwise.

Statute’s own ages: Signal brackets: under 13; 13 to under 16; 16 to under 18; 18 or older (Cal. Civ. Code § 1798.501(a)(2)).

Cal. Civ. Code § 1798.502 (developer duties): exact subsection pin pending verification

Minor data protectionUnder 1313–1516–17effective 2027-01-01

Plain:Do not request more information than necessary to comply with the Act, and do not share the age signal with a third party for any purpose the Act does not require.

Cal. Civ. Code § 1798.502: exact subsection pin pending verification

Age rating & store signalsUnder 1313–1516–17effective 2027-01-01

Plain:Operating-system providers must collect the primary user's birth date or age at account setup and, on a developer's request, supply a real-time signal of the user's age bracket, minimizing data shared to what compliance requires.

Statute’s own ages: Signal brackets: under 13; 13 to under 16; 16 to under 18; 18 or older (Cal. Civ. Code § 1798.501(a)(2)).

Cal. Civ. Code § 1798.501: exact subsection pin pending verification

Cross-state comparisons

similarca-aadc (California): Same jurisdiction; complementary rather than duplicative. AB 1043 supplies a standardized device/OS-level age-bracket signal that a business could use to meet AADC-style age-estimation needs without collecting identity documents.
similarut-sb142 (Utah): Shares the signal-based architecture of the app-store-accountability model, in which a platform (OS in AB 1043; app store in Utah SB 142) generates an age-category signal and app developers consume it, but AB 1043 does not require verifiable parental consent or bind app stores the way SB 142 binds them.

Sources: California Legislative Information: AB 1043 (2025-2026), Digital Age Assurance Act (Civ. Code §§ 1798.500-1798.505) · Troutman: Analyzing California's Digital Age Assurance Act · Alston & Bird: California Enacts Digital Age Verification Law

Protecting Our Kids from Social Media Addiction Act (SB 976) ↗

In forceResearchedlast verified 2026-07-04

Social media platform

Signed 2024-09-20; core provisions effective 2025-01-01. In NetChoice v. Bonta (N.D. Cal., No. 5:24-cv-07885-EJD), the district court on 2024-12-31 declined to enjoin the addictive-feed, default-setting, and age-verification provisions but enjoined the notification-restriction and annual-disclosure provisions on First Amendment grounds. After a full injunction pending appeal, the Ninth Circuit on 2025-09-09 affirmed the denial as to the addictive-feed and default-private-mode provisions (now enforceable) and reversed to enjoin the engagement-metric ('like'-count) default as content-based; rehearing en banc was denied 2025-11-06.

Regulation-level status is `in_force`: after the Ninth Circuit's 2025-09-09 ruling the addictive-feed parental-consent and default-setting provisions are enforceable, so obligation-level `enforcement_override: enjoined` marks the two currently blocked pieces: the notification restrictions (enjoined by the district court 2024-12-31) and the engagement-metric ('like'-count) default (enjoined per the Ninth Circuit). Enforcement is exclusively by the Attorney General with no private right of action (§ 27006(a), verified); the chapter's reviewed sections (§§ 27000–27007) do not fix a per-violation penalty amount, so `penalties.model` is `other` and no amount is asserted. The Act also requires operators to publicly disclose annual metrics about minor users (§ 27005): that duty was among the provisions enjoined 2024-12-31 and is not modeled as an obligation because it is a public transparency report rather than a minor-facing duty matching the requirement-type taxonomy; it is recorded here instead. Provision-level section pins are pending a full primary-text pass; the definitional (§ 27000.5) and enforcement (§ 27006) sections are verified, and the notification hours, default-setting, and litigation facts are drawn from the cited court order, Ninth Circuit opinion, and secondary legal analysis.

Scope

Binds the 'operator' of an 'addictive internet-based service or application', a service that offers users an 'addictive feed' (media recommended, selected, or prioritized based on information associated with the user or their device) as a significant part of the service (Cal. Health & Safety Code § 27000.5). A 'minor' is a user under 18 located in California.

Coverage conditions

Coverage of a service turns on its offering an 'addictive feed' as a significant part of the service; the feed definition excludes, among others, content not persistently associated with a user, content responsive to a user's specific search or express request, direct private communications, and sequential content from a single author.(Cal. Health & Safety Code § 27000.5 (definition of 'addictive feed' and 'addictive internet-based service or application'))

Express exemptions

The 'addictive internet-based service or application' definition excludes services whose feeds operate primarily for cloud-storage of the user's own data, and platforms for commercial transactions or consumer reviews, as described in the definitional section.(Cal. Health & Safety Code § 27000.5: exclusions from 'addictive internet-based service or application')

Provision-level section pins within Chapter 24 (Health & Safety Code §§ 27000–27007) are pending a full primary-text pass; the definitional (§ 27000.5) and enforcement (§ 27006) sections are verified.

Penalties

Model: Other
Detail: Enforceable only in a civil action brought in the name of the people of the State of California by the Attorney General (Cal. Health & Safety Code § 27006(a)); the chapter (§§ 27000–27007) does not fix a per-violation penalty amount in the sections reviewed. The Attorney General is directed to adopt regulations, including on age assurance and parental consent, by 2027-01-01.
Enforcer: California Attorney General
Private right of action: No

Key dates

Signed: 2024-09-20
Effective: 2025-01-01

Obligations (6)

Addictive-feature restrictionsUnder 1313–1516–17

Plain:Do not provide an addictive (algorithmically prioritized) feed to a user the operator has actual knowledge is a minor without first obtaining verifiable parental consent.

Statute’s own ages: Applies to users under 18 located in California; the operative standard is the operator's 'actual knowledge' that a user is a minor from 2025-01-01, with age-assurance regulations due from the Attorney General by 2027-01-01.

Cal. Health & Safety Code §§ 27000 et seq. (SB 976, 2024): provision section pin pending verification against the enacted text

Default-high privacy for minorsUnder 1313–1516–17

Plain:By default, set a known minor's account to a private mode in which only users connected to the minor's account can view or interact with the minor's content, absent a permitted change.

Statute’s own ages: Applies to users under 18 located in California.

Cal. Health & Safety Code §§ 27000 et seq. (SB 976, 2024): provision section pin pending verification; the private-mode default was upheld against facial challenge by the Ninth Circuit on 2025-09-09

Addictive-feature restrictionsUnder 1313–1516–17

Plain:Apply the statute's default limits on a known minor's access to the addictive feed (including a default limiting addictive-feed access), changeable only through the process the Act specifies.

Statute’s own ages: Applies to users under 18 located in California.

Cal. Health & Safety Code §§ 27000 et seq. (SB 976, 2024): default-settings provision; section pin pending verification against the enacted text

Curfew / time restrictionsUnder 1313–1516–17

Plain:Do not send notifications to a known minor between 12:00 a.m. and 6:00 a.m., or between 8:00 a.m. and 3:00 p.m. Monday through Friday from September through May, in the minor's local time, without verifiable parental consent.

Statute’s own ages: Applies to users under 18 located in California.

EnjoinedThis provision differs from the law’s overall status: Preliminarily enjoined by the district court on 2024-12-31 (NetChoice v. Bonta, N.D. Cal.) as likely to compel speech in violation of the First Amendment; that provision-level injunction was not disturbed by the Ninth Circuit's 2025-09-09 ruling, which addressed the addictive-feed, private-mode, and engagement-metric provisions.

Cal. Health & Safety Code §§ 27000 et seq. (SB 976, 2024): notification-restriction provision; section pin pending verification against the enacted text

Design / dark-pattern restrictionsUnder 1313–1516–17

Plain:By default, do not display the number of 'likes' or other engagement/feedback metrics on content shown to a known minor.

Statute’s own ages: Applies to users under 18 located in California.

EnjoinedThis provision differs from the law’s overall status: The Ninth Circuit on 2025-09-09 held this provision a content-based restriction that fails strict scrutiny and is severable, and remanded with instructions to enjoin it; it is therefore unenforceable while the remaining provisions stand.

Cal. Health & Safety Code §§ 27000 et seq. (SB 976, 2024): engagement-metric default provision; section pin pending verification against the enacted text

Age verification / estimationUnder 1313–1516–17effective 2027-01-01

Plain:Use the age-assurance and verifiable-parental-consent methods the Attorney General adopts by regulation (due 2027-01-01) to identify minor users and obtain parental consent; until those regulations operate, the Act's duties turn on the operator's actual knowledge that a user is a minor.

Statute’s own ages: Applies to users under 18 located in California; the age-assurance regime broadens the knowledge standard once the Attorney General's regulations take effect (due 2027-01-01).

Cal. Health & Safety Code § 27006(b) (Attorney General to adopt age-assurance and parental-consent regulations by 2027-01-01)

Litigation history

2024-11-12
NetChoice filed suit against Attorney General Rob Bonta in the U.S. District Court for the Northern District of California (No. 5:24-cv-07885-EJD, Judge Edward J. Davila), seeking to enjoin SB 976 on First Amendment grounds before its 2025-01-01 effective date
→ Pre-enforcement facial challenge; the challenged provisions were not yet operative source ↗
2024-12-31
District court granted in part and denied in part NetChoice's motion for a preliminary injunction: it declined to enjoin the addictive-feed, default-setting, and age-verification provisions, but preliminarily enjoined the notification-restriction and the annual-disclosure provisions as likely to compel speech in violation of the First Amendment
→ Addictive-feed, default-setting, and age-verification provisions left to take effect 2025-01-01; the notification-restriction and annual-disclosure provisions enjoined source ↗
2025-01-02
District court granted NetChoice a temporary injunction of the entire Act (roughly 30 days) to preserve the status quo while NetChoice sought an injunction pending appeal
→ Entire Act temporarily unenforceable pending the Ninth Circuit's action source ↗
2025-01-28
A Ninth Circuit motions panel granted an injunction pending appeal, halting enforcement of the Act while the appeal proceeded
→ Entire Act unenforceable during the appeal source ↗
2025-09-09
Ninth Circuit (3-0, opinion by Judge Ryan D. Nelson) affirmed the denial of a preliminary injunction as to the addictive-feed parental-consent provision and the private-mode default-setting provision (which survived intermediate scrutiny), and reversed as to the engagement-metric ('like'-count) default provision, holding it a content-based restriction that fails strict scrutiny and is severable, and remanding with instructions to enjoin that provision
→ Addictive-feed parental-consent and private-mode default provisions enforceable; engagement-metric default provision enjoined source ↗
2025-11-06
Ninth Circuit denied NetChoice's petition for rehearing en banc
→ No change: the panel disposition stands; the case returns to the district court for further proceedings source ↗

Cross-state comparisons

similarny-safe-for-kids (New York): New York's SAFE for Kids Act follows SB 976's template: both bar serving an algorithmic ('addictive') feed to a known minor without verifiable parental consent, and both restrict nighttime notifications to minors. SB 976 adds weekday school-hours (8 a.m.-3 p.m.) notification limits and reached an enforceable posture earlier, while New York's obligations remain gated on OAG rulemaking.
similarca-aadc (California): Both are California minor-protection statutes that were partially narrowed by the Ninth Circuit on First Amendment grounds, but via different levers: the AADC imposes age-estimation, design, and data-protection duties on services likely to be accessed by minors, while SB 976 targets addictive feeds, default settings, and notifications for known minors.

Sources: California Legislative Information: SB 976 (Protecting Our Kids from Social Media Addiction Act), bill text · California Attorney General: SB 976 rulemaking (age-assurance and parental-consent regulations, due 2027-01-01) · Cal. Health & Safety Code § 27006: Attorney-General-only enforcement; no private right of action; regulations due 2027-01-01 · Cal. Health & Safety Code § 27000.5: definitions ('addictive feed', 'addictive internet-based service', 'operator', 'minor') · NetChoice, LLC v. Bonta: Ninth Circuit opinion (No. 25-146, 2025-09-09) · Hunton: Ninth Circuit Upholds Addictive-Feed Ban and Default Privacy Settings in SB 976 · NetChoice: NetChoice v. Bonta (California SB 976) case page and litigation timeline