ARTICLE
29 September 2026

California Enacts Five Children’s Online Privacy Laws

SM
Sheppard, Mullin, Richter & Hampton LLP

Contributor

Businesses turn to Sheppard to deliver sophisticated counsel to help clients move ahead. With more than 1,200 lawyers located in 16 offices worldwide, our client-centered approach is grounded in nearly a century of building enduring relationships on trust and collaboration. Our broad and diversified practices serve global clients—from startups to Fortune 500 companies—at every stage of the business cycle, including high-stakes litigation, complex transactions, sophisticated financings and regulatory issues. With leading edge technologies and innovation behind our team, we pride ourselves on being a strategic partner to our clients.
California will have a range of new laws going into effect aimed at protecting children from online features. Governor Gavin Newsom signed five bills (AB 1709, AB 2246, AB 1856, SB 1119, and SB 867) into law on September 10, 2026.
United States California Media, Telecoms, IT, Entertainment

California will have a range of new laws going into effect aimed at protecting children from online features. Governor Gavin Newsom signed five bills (AB 1709, AB 2246, AB 1856, SB 1119, and SB 867) into law on September 10, 2026. The five are as follows:

  • Addictive Features: Beginning January 1, 2027, covered platforms may not provide “addictive features” to users under 16 under AB 1709. Addictive features include an algorithmic feed that recommends content based on a user’s activity, autoplay, and other features intended to maximize engagement that lead to compulsive use. Covered platforms are defined as those that make user-generated content available and have addictive features as a significant part of their service. The bill directs the California Department of Justice to establish an e-Safety Advisory Commission.
  • Children’s Design Code Act: California has repealed and replaced the California Age-Appropriate Design Code Act with AB 2246. (We have written previously about the challenges the prior law faced.) The amended law goes into effect January 1, 2027, and will apply to businesses that offer online services, products, or features likely to be accessed by children under 18. These companies will be required to take reasonable steps to prevent specified risks of harm to children. This includes limits on profiling, use of children’s personal information, privacy settings, and dark patterns. The amendments narrow provisions the legislature feared would be challenged, and retains provisions that had not been enjoined.
  • AI Companion Chatbots for Kids: Companion chatbots directed to children will be subject to new requirements under SB 1119, known as the Leading Ethical AI Development for Kids Act. Beginning July 1, 2027, the law will require operators to maintain protocols for identifying and responding to child users who may be at risk of self-harm. The law also imposes child-safety governance requirements, including annual risk assessments that evaluate potential harms to minors and independent child-safety audits of covered companion chatbot services. These will begin January 1, 2029. Operators must document compliance efforts and make certain information available to the Attorney General upon request. It also requires disclosures that a user is interacting with AI and provides for Attorney General enforcement.
  • AI-Chatbot-Enabled Toys: Certain toys containing companion chatbots will be restricted under SB 867 until January 1, 2031. Specifically, the law will prohibit the manufacture, sale, exchange, or offer for sale of a toy that includes a companion chatbot. It will apply to physical products designed, marketed, or made for play by children under 16.
  • Age Assurance: Operating-system providers have new age-assurance obligations under AB 1856, which amends the Digital Age Assurance Act. As amended, beginning January 1, 2027, covered providers must offer an account-setup interface for age information. This obligation mirrors what we have seen in Texas. Covered providers are narrowly defined to those that control the operating-system software on a computer or mobile device. If an application store or application developer requests, these entities will also need to provide age-bracket signals. Ranges are under 13, 13 to 15, 16 to 17, or 18 or older.

Putting it Into Practice. These five California laws will place obligations on entities that provide online or interactive services likely to be accessed by children. This includes companion-chatbots and chatbot-enables toys. The age assurance obligations requirements will have similar impacts on companies as that which we have seen in Texas. We anticipate that many of these provisions may be challenged prior to their effective dates.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

[View Source]

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More