Written by: Haim Ravia, Dotan Hammer
On September 11, 2026, Governor Gavin Newsom signed thirteen laws establishing the most comprehensive state-level framework in the United States for the protection of minors online. The package rests on three pillars: design restrictions on services directed at or used by children, age verification obligations, and dual enforcement through the California Attorney General and private lawsuits. Applicability turns on the location of the user rather than the place of incorporation, so non-U.S. companies serving California residents are within scope. Most provisions take effect on January 1, 2027.
Regarding design and access, AB 1709 prohibits platforms from supplying “addictive features” (algorithmic feeds, autoplay, and further features to be designated by regulation) to users under 16. Minors may keep accounts, but the features must be disabled. A violation requires deletion of the account, with penalties of up to USD 50,000 per minor for a knowing violation and USD 25,000 for a negligent one. AB 2 grants parties suing social platforms in negligence statutory damages equal to the greater of USD 5,000 per violation, USD 1 million per child, or treble actual damages, against platforms with annual revenue above USD 100 million, sunsetting on January 1, 2035.
AB 2246 replaces California’s earlier child-appropriate design code with obligations for services “reasonably likely to be accessed by children” under 18, identified through six indicators including the company’s own internal market research. It requires enhanced privacy defaults, visible notification of monitoring, prohibition of profiling and secondary use of data by default, and a ban on dark patterns, with penalties up to USD 15,000 per child and no private right of action.
AB 1856 distributes age-verification responsibility among operating system providers, application stores, and developers through four categories of age signal. A developer that receives an age signal is deemed to have actual knowledge of the user’s age, eliminating the defense of ignorance.
SB 1119, the Adam Act, is the most far-reaching chatbot regulation adopted in the United States. Operators must conduct risk assessments before launch and major updates; implement crisis protocols providing for parental notification or access to a mental health hotline where suicidal ideation is detected; and apply parent-controlled defaults including disabled conversation memory, disabled notifications, a maximum of one hour of continuous chat, and two hours per day. Fourteen behaviors are prohibited outright, among them expressing romantic interest in a minor, claiming consciousness or emotions, encouraging emotional dependency, excessive flattery, discouraging breaks, and circumventing parental controls. Where a death or serious self-harm occurs, chat records must be retained for three years and the account may not be deleted. Periodic external audits are required, with summaries to the Attorney General, and penalties reach USD 15,000 per child with a private right of action. SB 867 bans outright the manufacture, sale, or retail offering of toys containing social chatbots, sunsetting on January 1, 2031.
On child sexual abuse material (CSAM), AB 1946 expands platform detection obligations, redefines CSAM to include AI-generated “digital forgeries,” removes the requirement that the complainant appear in the reported content, and mandates human review where no hash match exists — retaining timelines for blocking within 48 hours, approval within 72 hours, and final determination within seven days, with a penalty of USD 250,000 per day of violation.
SB 1276 expands criminal liability for downloading, streaming, and accessing exploitative material, expressly covering AI-created or AI-modified content. Of particular significance for AI developers, AB 1159 imposes a blanket prohibition, with no consent exception, on using student information to train generative models or develop AI systems, and bars online services for students from collecting data on sexual health, migration status, sexual orientation, or gender identity, with a parallel statute for higher education and a private right of action of USD 500 per plaintiff per violation.
The package is completed by additional laws addressing school enrichment activities, device confiscation in kindergarten, digital wellness instruction, and cybersecurity skills in the curriculum.
Click here for the California Governor’s press release on signing “the strongest child safety chatbot and social media laws in the nation”.
