California Passes Age-Appropriate Privacy Act
On September 15, 2022, California Governor Gavin Newsom signed the California Age-Appropriate Design Code Act (“AB 2273” or the “Act”), which is directed at businesses providing online services, products, or features likely to be accessed by persons under the age of 18.
AB 2273 prohibits companies that provide online services, products, or features “likely to be accessed by children” to comply with specified requirements, such as:
configuring all default privacy settings to offer a high level of privacy, or, to prove that their selected privacy level is “in the best interest of the child”
providing consumers with privacy information, terms of service, policies and community standards in a concise, prominent, and clear manner “suited to the age of children likely to access that online service, product, or feature”;
completing a mandatory “Data Protection Impact Assessment” for any new online services, products, or features being offered to the public and “likely to be accessed by children”; maintain documentation of this assessment so long as this access remains likely; and make this assessment available, upon written request, within 5 business days to the Attorney General;
complying with the prohibition against taking proscribed action, such as using a child’s personal information “for any reason other than a reason for which the personal information was collected, unless the business can demonstrate a compelling reason that use of the personal information is in the best interests of children.”
According to a statement by Governor Newsom, this Act is the “aggressive action” necessary “to protect the health and wellbeing of our kids[.]” Newsom stated that he, as a parent, is “terrified of the effects technology addiction and saturation are having on our children and their mental health.” This Act, Newsome states, is a means of holding tech companies “accountable for the online spaces they design and the way those spaces affect California’s children.”