Serves under-18s, in California

Cal. Bus. and Prof. Code sections 22580 to 22582 · Read the law's page

• If your website, online service or app is directed to minors, meaning it is created to reach an audience predominately comprised of minors and is not intended for a more general audience of adults, do not market or advertise on it any product or service listed in section 22580(i), among them alcoholic beverages, firearms, ammunition, tobacco and electronic cigarettes, cannabis, dangerous fireworks, lottery tickets, tanning in an ultraviolet device, tattoos and body branding, drug paraphernalia and obscene matter. Marketing or advertising means a communication made in exchange for monetary compensation.
• Whatever your audience, do not market or advertise those products or services to a minor (a person under 18 who lives in California) you have actual knowledge is using your service, when the marketing is specifically directed to that minor based on information specific to the minor, such as profile, activity, address or location. Reasonable actions in good faith to avoid that marketing count as compliance.
• If your service is directed to minors or you have actual knowledge that a minor uses it, do not knowingly use, disclose or compile the minor's personal information, or allow a third party to, with actual knowledge that it is for marketing or advertising those products or services to that minor.
• If your service is directed to minors or you have actual knowledge that a minor uses it, let a minor who is a registered user remove, or request and obtain removal of, content or information the minor posted. Give the minor notice that they may do so, clear instructions for doing so, and notice that removal does not ensure complete or comprehensive removal.
• You need not erase content that a federal or state law requires you to keep, that a third party stored or posted, that you anonymize, that a minor who did not follow your removal instructions posted, or that the minor was paid to provide. Making the content invisible to other users and the public is enough even if it stays on your servers. You are not required to collect or retain age information about users.
• If you run an advertising service and an operator notifies you, in the manner you require, that its service is directed to minors, do not market or advertise those products or services on that operator's service.

Cal. Civ. Code § 1798.99.1, as amended by AB 2076 (Ch. 920, Stats. 2026) · Read the law's page

• Take reasonable steps to ensure that the purchaser is of legal age at the time of purchase or delivery, including verifying the age of the purchaser, if you conduct business in California and seek to sell any product or service in or into California that is illegal under state law to sell to a minor (Civil Code Section 1798.99.1(a)(1)).
• For firearms, ammunition, tobacco, electronic cigarettes and the other products in subdivision (c), reasonable steps include requiring the purchaser or recipient to input, scan, provide, or display a government-issued identification or shipping the product or service to an individual who is of legal age (Section 1798.99.1(a)(3)).
• Do not treat consent obtained through the minor as a reasonable step (Section 1798.99.1(a)(4)).
• Do not retain, use, or disclose information you receive from a purchaser or recipient to verify age for any purpose other than complying with, or demonstrating compliance with, the section, California law, or a state or federal court order (Section 1798.99.1(a)(6)).
• From January 1, 2027, do not allow a purchaser to use a gift card or store credit for the products or services in subdivision (c), which then include nitrous oxide (Section 1798.99.1(a)(3)(B) and (c)(7), as amended by AB 2076).

Cal. Civ. Code section 1798.81.5, as amended by AB 825 (2021, Ch. 527) · Read the law's page

• This binds a business that owns, licenses, or maintains personal information about a California resident, and by contract extends the same duty to a nonaffiliated third party the business discloses that information to; it exempts a health care provider, plan, or contractor already regulated by the Confidentiality of Medical Information Act, a financial institution subject to the California Financial Information Privacy Act, a covered entity governed by the federal HIPAA medical privacy and security rules, and a business already subject to state or federal law providing greater protection on the same subject, deemed compliant with this duty instead.
• Implement and maintain reasonable security procedures and practices appropriate to the nature of the personal information you own, license, or maintain, to protect it from unauthorized access, destruction, use, modification, or disclosure.
• Covered personal information reaches a name paired with a Social Security, driver's license, state ID, passport, military ID, or tax ID number, a financial account or payment card number with its access code, medical or health insurance information, unique biometric data used to authenticate a person, or genetic data, when either the name or the data element is not encrypted or redacted; it also reaches a username or email address paired with a password or security question that unlocks an online account.
• A customer injured by a violation of this duty may bring a civil action for damages under Civil Code section 1798.84(b); where the violation is a breach of nonencrypted or nonredacted personal information, the CCPA/CPRA's own statutory-damages private right of action, Civil Code section 1798.150, is a separate and further remedy, researched as this jurisdiction's privacy row.

Cal. Code Regs. tit. 11, sections 7070 to 7072 · Read the law's page

• If you have actual knowledge that you sell or share the personal information of a consumer less than 13 years of age, establish, document and comply with a reasonable method for determining that the person consenting to the sale or sharing is the child's parent or guardian. This is in addition to any verifiable parental consent COPPA requires (section 7070(a)).
• If you have actual knowledge that you sell or share the personal information of a consumer at least 13 and less than 16 years of age, establish, document and comply with a reasonable process for the consumer to opt in to the sale or sharing under section 7028, and when you receive an opt-in request tell the consumer of the ongoing right to opt out and how to do so (section 7071).
• Describe those processes in your privacy policy (section 7072(a)).

Cal. Bus. and Prof. Code Sections 22601 to 22606 · Read the law's page

• If a reasonable person interacting with your companion chatbot could be misled into believing they are talking to a human, issue a clear and conspicuous notification that the chatbot is artificially generated and not human
• Do not let a companion chatbot on your platform engage with users unless you maintain, and publish on your website, a protocol for preventing it from producing suicidal ideation, suicide, or self-harm content, including a notification referring the user to a crisis hotline or crisis text line
• For a user you know is a minor, disclose that they are interacting with artificial intelligence, and provide a clear and conspicuous break reminder by default at least every three hours during continuing interactions (Section 22602(c)(1) and (2), deleted by SB 1119 effective January 1, 2027)
• For a user you know is a minor, take reasonable measures to prevent your companion chatbot from producing visual sexually explicit material or directly telling the minor to engage in sexually explicit conduct (Section 22602(c)(3), deleted by SB 1119 effective January 1, 2027)
• Disclose, wherever a user can access your companion chatbot platform, that companion chatbots may not be suitable for some minors (Section 22604)
• Beginning 1 July 2027, report annually to the Office of Suicide Prevention on the crisis-referral notifications you issued and the protocols you have in place, without including user identifiers or personal information
• A companion chatbot used only for customer service, internal business purposes, or as a limited video-game feature, or a stand-alone voice-command consumer device that does not sustain a relationship across interactions, falls outside this chapter

Cal. Civ. Code §§ 1798.99.28-1798.99.40 · Read the law's page

• A March 12, 2026 Ninth Circuit ruling vacated the injunction as to the entire Act, including the coverage definition and the age estimation requirement, affirmed it only as to the data use and dark patterns restrictions, and remanded to the district court to decide whether the remaining provisions are severable.
• Applies to a business providing an online service, product or feature likely to be accessed by children under 18. Complete data protection impact assessments.
• Configure default settings for high privacy and safety.
• Avoid dark patterns and profiling of minors.

AB 1946 (Ch. 185, Stats. 2026), Cal. Civ. Code Sections 3273.65 to 3273.67 and 3345.1 · Read the law's page

• If you operate a social media platform, provide a clear and conspicuous reporting mechanism, reasonably accessible to users and free of dark patterns, that lets a California resident report material they reasonably believe is child sexual abuse material displayed, stored or hosted on your platform, including material sent through direct messaging that is not end-to-end encrypted (Civil Code Section 3273.66(a)).
• Collect information sufficient to contact each reporting user, and contact them in writing by the method they choose (Section 3273.66(b)(1), (c)).
• Have a natural person review a report when there is no established or known hash match to child sexual abuse material and the reported material is not otherwise blocked (Section 3273.66(b)(2)).
• Within 48 hours of a report, permanently block the reported instance from view if there is a reasonable basis to believe it is child sexual abuse material hosted on your platform and the report has basic identifying information sufficient to locate it, and make reasonable efforts to remove and block other instances of the same material (Section 3273.66(d)).
• Within 72 hours of the first report, send the reporting user written confirmation of the actions taken, and within seven days send a final written determination that the material was blocked, was not child sexual abuse material, or was not hosted on your platform (Section 3273.66(e) to (g)).
• If circumstances beyond your reasonable control prevent compliance within 48 hours, give the reporting user written notice of the delay within 48 hours of knowing it was likely, and comply no later than 10 days after the first report (Section 3273.66(h)).
• Restore the reporting mechanism if it becomes unavailable or nonfunctional (Section 3273.66(i)).
• To keep the defense in Section 3345.1(g)(3) against a claim of knowingly facilitating commercial sexual exploitation, maintain a program of at least biannual audits of your designs, algorithms, practices, affordances and features, act on each audit within 30 days, give each audit to your board of directors within 90 days, and submit the audits to the Attorney General.

AB 2 (Ch. 180, Stats. 2026), Cal. Civ. Code Section 1714.02 · Read the law's page

• If you operate a social media platform that generates more than $100,000,000 a year in gross revenues, exercise ordinary care and skill in the management of your platform and its features; an injury to a child caused by a want of ordinary care or skill makes you liable for statutory damages of the larger of $5,000 per violation, up to $1,000,000 per child, or three times the child's actual damages (Civil Code Sections 1714(a), 1714.02(a)).
• A term of service or contract clause that waives the section is void and unenforceable, so it does not limit your liability for an injury to a child (Section 1714.02(b)).

Cal. Bus. & Prof. Code §§ 21810-21818 · Read the law's page

• Applies to an operator, a person who makes a companion chatbot available to a user in the state, other than a postsecondary educational institution that makes one available exclusively for educational settings and an entity that makes one available exclusively to its personnel for workplace use.
• Determine the age of each user under the Digital Age Assurance Act; if that cannot be done, rely on the age determination made under Health and Safety Code Section 27001; otherwise apply the child protections of Sections 21812(d) and 21813 to all users.
• Before making a new or substantially modified companion chatbot available, perform and document a comprehensive risk assessment of covered harms to child users, and take and document measures that reasonably mitigate the child safety risks it identifies.
• Publish on the operator's website a description of how it complies with the age assurance requirements if it prohibits child users, or a child safety policy if it permits them.
• For a child user, implement a documented crisis response protocol, including a referral to a crisis service and, on a credible and imminent threat of suicide or self-harm, notice to a linked parent or streamlined access to the 988 line or an equivalent helpline.
• For a child user, set defaults that only a parent can change: disable persistent conversational memory and push notifications, and limit a single continuous session to one hour and total daily use to two hours; parental controls must let the parent adjust each setting and disable access for a child under 16.
• Give a child user periodically reinforced notice, in language and a format appropriate to a child, that the child is interacting with an artificial intelligence system.
• Take reasonable measures to prevent the chatbot, with respect to a child user, from encouraging self-harm, engaging in obscene matter or sexual abuse material, expressing or simulating romantic interest, claiming to be sentient or human, or discouraging the child from taking breaks.
• Provide a public incident reporting mechanism for third parties to report a child safety risk, and test the interface design of the safety features with representative child users and parents on or before January 1, 2028 and every two years after.
• Do not display cross-context behavioral advertising to a child, target advertising at a child using personal information in a conversational chat, sell a child's personal information gathered through the chatbot, or use a dark pattern in the safety features and controls; label any advertising shown to a child.
• Preserve for at least three years any record of a conversation with a child user that indicates serious self-harm or risk of self-harm, and do not delete the child's account while it is associated with a preserved record.
• Have an independent third-party child safety audit performed on or before January 1, 2029 or before first making the chatbot publicly available, whichever is later, and every two years after; submit a summary to the Attorney General within 30 business days and post a high-level summary within 90 days. An operator with less than $500,000,000 in gross revenue in the prior calendar year is not required to comply with the audit duty before January 1, 2032.

Cal. Civ. Code §§ 1798.99.28-1798.99.34 · Read the law's page

• Applies to a business that provides an online service, product, or feature likely to be accessed by children, meaning consumers under 18, other than a broadband internet access service, a telecommunications service, or the delivery or use of a physical product.
• Estimate the age of child users with a reasonable level of certainty appropriate to the risks arising from the business's data management practices, or apply the privacy and data protections afforded to children to all consumers.
• Configure all default privacy settings provided to children to settings that offer a high level of privacy.
• Provide privacy information, terms of service, policies, and community standards concisely, prominently, and in clear language suited to the age of children likely to access the service.
• Give a child an obvious signal when the child's parent, guardian, or another consumer is monitoring the child's online activity or tracking the child's location.
• Provide prominent, accessible, and responsive tools to help children, or their parents or guardians, exercise their privacy rights and report concerns.
• Do not profile a child by default unless the business can demonstrate appropriate safeguards and the profiling is necessary to provide the service the child is actively and knowingly engaged with, or to enhance the safety, privacy, or education of the child.
• Do not collect, sell, share, or retain personal information that is not necessary to provide the service with which a child is actively and knowingly engaged, other than as described in subparagraphs (A) to (D) of paragraph (1) of subdivision (a) of Section 1798.145 of the Civil Code.
• Do not use a child's personal information for a reason other than the one for which it was collected, except to ensure the safety, integrity, or security of the service, for measurement, auditing, and system improvement, or to comply with the title.
• Do not collect, sell, or share a child's precise geolocation by default, and give the child an obvious sign for as long as precise geolocation is being collected.
• Do not use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected or to forgo privacy protections.
• Do not retain personal information collected to estimate age for any other purpose or longer than necessary to estimate age; age assurance must be proportionate to the risks and data practices of the service.
• Take reasonable steps to prevent reasonably foreseeable physical or financial harm to children, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, a highly offensive intrusion on privacy rights, and adverse discrimination in violation of state or federal law.

SB 867 (Ch. 189, Stats. 2026), Cal. Bus. and Prof. Code Section 22604.5 · Read the law's page

• If you manufacture, sell or exchange toys, possess toys with intent to sell or exchange them, or offer toys to a retailer, do not include a companion chatbot in a toy, meaning a physical product designed, marketed, or manufactured for use in play by children under 16 years of age (Section 22604.5(a)).
• Do not supply a toy that includes an artificial intelligence system with a natural language interface that gives adaptive, human-like responses to user inputs and can sustain a relationship across multiple interactions, other than a bot limited to customer service or similar business purposes, a limited video game bot or a stand-alone voice-command speaker (Sections 22601(b), 22604.5(a)).