California Enacts New Privacy Regime For Children Aligned With Britain’s

California’s new child and teen aimed data privacy and protection bill is making waves elsewhere in the U.S.

Governor Gavin Newsom (D) signed “ The California Age-Appropriate Design Code Act” (AB 2273), which he called “bipartisan landmark legislation aimed at protecting the wellbeing, data, and privacy of children using online platforms.” This law is based on regulation pioneered in Europe, and a number of American multinationals are already complying with that regime. The new California statute requires entities offering services, products, and features that children are likely to access to assess and remediate risks to children. Other aspects require these companies to account for the best interests of the child.

When AB 2273 was first introduced, I analyzed the bill (see here for more detail and analysis) and found that it sought to graft the United Kingdom’s (UK) Information Commissioner's Office's (ICO) Age Appropriate Design Code (aka the Children’s Code) onto the California Code. Entities that violate the Children’s Code invite ICO regulatory action under the UK’s “Data Protection Act 2018.” Consequently, a number of American multinationals like Facebook, Snapchat, and others committed in one way or another to heeding the Children’s Code. This development naturally led U.S. lawmakers in the Congress to demand the same for Americans under the age of 18, including from Amazon, Facebook, Google, Snapchat, TikTok, and Twitter and gaming companies. However, these calls have largely been ignored.

Nonetheless, in the U.S. states can, of course, regulate data privacy for children so long as it comports with federal law. The Children’s Online Privacy Protection Act (COPPA) (15 U.S.C. 6501 et. seq.) preempts inconsistent state privacy laws. Consequently, states and localities may enact statutes that impose liability on commercial activities or entities for the same activity or action regulated COPPA so long as the state laws are consistent with COPPA. It seems likely opponents of AB 2273 will try to make the case that the new statute conflicts with COPPA and is therefore preempted. There is little in the way of conflict I can see between COPPA and its regulations and AB 2273. Against this backdrop, California lawmakers opted to enact what they consider enhanced protection for children and teens under 18.