Law / United States / 
California
AB 2246 (2026), Online Services, Products, or Features Likely to be Accessed by Children
Cal. Civ. Code §§ 1798.99.28-1798.99.34
An age-appropriate design code rule binding private bodies.
- Enforcement body
- California Attorney General or a public prosecutor
- Audit expectation
- none
As of .
What it requires
- Applies to a business that provides an online service, product, or feature likely to be accessed by children, meaning consumers under 18, other than a broadband internet access service, a telecommunications service, or the delivery or use of a physical product.
- Estimate the age of child users with a reasonable level of certainty appropriate to the risks arising from the business's data management practices, or apply the privacy and data protections afforded to children to all consumers.no control in the NIST Privacy Framework
- Configure all default privacy settings provided to children to settings that offer a high level of privacy.NIST Privacy FrameworkGV.PO-P2
- Provide privacy information, terms of service, policies, and community standards concisely, prominently, and in clear language suited to the age of children likely to access the service.NIST Privacy FrameworkCM.AW-P1
- Give a child an obvious signal when the child's parent, guardian, or another consumer is monitoring the child's online activity or tracking the child's location.NIST Privacy FrameworkCM.AW-P3
- Provide prominent, accessible, and responsive tools to help children, or their parents or guardians, exercise their privacy rights and report concerns.NIST Privacy FrameworkCT.PO-P3NIST Privacy FrameworkGV.MT-P7
- Do not profile a child by default unless the business can demonstrate appropriate safeguards and the profiling is necessary to provide the service the child is actively and knowingly engaged with, or to enhance the safety, privacy, or education of the child.NIST Privacy FrameworkCT.PO-P1
- Do not collect, sell, share, or retain personal information that is not necessary to provide the service with which a child is actively and knowingly engaged, other than as described in subparagraphs (A) to (D) of paragraph (1) of subdivision (a) of Section 1798.145 of the Civil Code.NIST Privacy FrameworkCT.PO-P1
- Do not use a child's personal information for a reason other than the one for which it was collected, except to ensure the safety, integrity, or security of the service, for measurement, auditing, and system improvement, or to comply with the title.NIST Privacy FrameworkCT.PO-P1
- Do not collect, sell, or share a child's precise geolocation by default, and give the child an obvious sign for as long as precise geolocation is being collected.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkCM.AW-P3
- Do not use dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected or to forgo privacy protections.NIST Privacy FrameworkCT.PO-P1
- Do not retain personal information collected to estimate age for any other purpose or longer than necessary to estimate age; age assurance must be proportionate to the risks and data practices of the service.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.PO-P1
- Take reasonable steps to prevent reasonably foreseeable physical or financial harm to children, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, a highly offensive intrusion on privacy rights, and adverse discrimination in violation of state or federal law.NIST Privacy FrameworkID.RA-P5
These lines are LexLint's reading of the law's text, as of .
In the frameworks
- NIST Privacy Framework
- ID.RA-P5Risk responses are identified, prioritized, and implemented.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- GV.MT-P7Policies, processes, and procedures for receiving, tracking, and responding to complaints, concerns, and questions from individuals about organizational privacy practices are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
- CT.DM-P5Data are destroyed according to policy.
2 more
- CM.AW-P1Mechanisms (e.g., notices, internal or public reports) for communicating data processing purposes, practices, associated privacy risks, and options for enabling individuals’ data processing preferences and requests are established and in place.
- CM.AW-P3System/product/service design enables data processing visibility.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalty structure
Up to $5,000 per affected child for each negligent violation and up to $15,000 per affected child for each intentional violation, together with an injunction, recovered only in a civil action brought by the Attorney General or a public prosecutor. The figure recorded here is the intentional-violation tier.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Person
- Per violation amount
- 15,000
What it reaches
Age threshold
18
Covered services
Online services, products, or features likely to be accessed by children, excluding broadband internet access service, telecommunications service, and the delivery or use of a physical product.
Obligation class
Design code, Age verification
What this law does
Requires a business that provides an online service, product, or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty, or to apply children's privacy and data protections to all consumers.
The business must also take reasonable steps to prevent reasonably foreseeable physical or financial harm to children, severe and reasonably foreseeable psychological or emotional harm to a reasonable child, a highly offensive intrusion on privacy rights, and adverse discrimination in violation of state or federal law. Any contract term entered into by a child or the child's parent or guardian as a result of a design feature of the service is voidable at the child's election.
The act repeals the California Age-Appropriate Design Code Act and replaces it with similar provisions. Under Article IV, section 8(c)(1) of the California Constitution, a statute enacted at a regular session goes into effect on the January 1 next following a 90-day period from its enactment, which for this act is .
When LexLint raises it
When your app profile says your app serves under-18s.