CA AADC
California Age-Appropriate Design Code Act
Would require child-protective defaults and assessments for services likely to be used by children. Its enforceability is being decided in court.
The law in brief
The California Age-Appropriate Design Code Act would require online services likely to be accessed by children under 18 to put children's interests first: protective default settings, clear privacy information, estimates of users' age, and limits on profiling, data use and manipulative design.
Its enforceability is being decided in court. The law was blocked in full in September 2023. In March 2026 the Ninth Circuit narrowed the injunction for the second time: the coverage definition and the age estimation requirement are no longer blocked on their face, but the challenged data use restrictions, the dark patterns prohibition and the impact assessment requirement remain blocked. The case has returned to the district court.
Who it applies to
- Businesses that provide an online service, product or feature likely to be accessed by children, where the business meets the California Consumer Privacy Act's definition of a business.
- Children means consumers under 18.
- Indicators of likely access include content directed to children, a significant number of child users, advertisements marketed to children, and design elements known to appeal to children.
Likely to be accessed by children
Covers online services where it is reasonable to expect children under 18 to use them, judged by indicators such as audience, content and design.
What it requires
High privacy by default
Configure default privacy settings for children to a high level of privacy, unless the business can show a compelling reason another setting is in the child's best interest.
Estimate age or protect everyone
Estimate the age of child users with reasonable certainty appropriate to the risks, or apply the child protections to all consumers.
Clear information
Provide privacy information, terms and policies concisely and in language suited to the age of children likely to use the service.
Blocked provisions
The impact assessment requirement, the challenged data use restrictions and the dark patterns prohibition remain preliminarily enjoined after the March 2026 decision.
Enforcement and penalties
The Attorney General can seek civil penalties per affected child, higher for intentional violations, and injunctions. Whether and when it can enforce each provision depends on the litigation.
What's changing
In litigation. After the Ninth Circuit's March 2026 decision, some provisions may be enforceable while others stay blocked, and the state previously agreed to hold off enforcement during the case. Check the current position before relying on any provision; Regulatory Watch reports court rulings.
What to do first
- Decide whether your service is likely to be accessed by children under the law's indicators.
- Set privacy-protective defaults for users who may be children, which is good practice in any event.
- Plan age estimation, or be ready to apply child protections to all users.
- Write privacy information that children can understand.
- Track the litigation and California's other children's laws before committing to a design.
Checked against the official text on 28 September 2026. Quotations are the operative words of the law, linked to the article they come from; the official text is the authority. This brief is written by the Association for practitioners and is not legal advice.
Recent developments
-
Future of Privacy Forum submits comments on Vermont Age-Appropriate Design Code rulemaking
The comments aim to shape Vermont’s upcoming rules on minors’ online privacy, influencing how businesses must design and operate digital services for children. On October 2, 2026 the Future of Privacy Forum filed comments to the Vermont Attorney General’s rulemaking for the Age-Appropriate Design Code. The act, enacted in June 2025, sets duties for businesses serving minors and will become effective on January 1, 2027. FPF’s recommendations focus on clarifying prohibitions, personalization, compulsive‑use metrics, and age‑assurance standards.
Source: Future of Privacy Forum. CA AADC in the regulations library.
-
EPIC comments on Vermont Attorney General's proposed Age-Appropriate Design Code rules
The comments influence how Vermont will enforce its children‑safety law, shaping privacy‑friendly age verification and design standards. On October 2, EPIC submitted comments on two proposed rules announced by the Vermont Attorney General to implement the state's Age-Appropriate Design Code. The rules target addictive design practices for minors and outline methods for age determination. EPIC urged more precise definitions of abusive designs and privacy‑preserving age‑assurance techniques.
Source: EPIC. CA AADC in the regulations library.
Sources
Primary sources are being added to this entry.