Law / United States / 
California
AB 2273 (2022), California Age-Appropriate Design Code Act
Cal. Civ. Code §§ 1798.99.28-1798.99.40
In force since partly blocked by a court, effective , under challenge in court.
An age-appropriate design code rule binding private bodies.
- Age threshold
- 18
- Covered services
- Online services, products, or features likely to be accessed by children.
- Verification methods
- Facial estimation, Self declaration
- Audit expectation
- periodic
- Who audits it
- Self
- Where the report goes
- Kept, Produced on request
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- A Ninth Circuit ruling vacated the injunction as to the entire Act, including the coverage definition and the age estimation requirement, affirmed it only as to the data use and dark patterns restrictions, and remanded to the district court to decide whether the remaining provisions are severable.
- Applies to a business providing an online service, product or feature likely to be accessed by children under 18. Complete data protection impact assessments.NIST Privacy FrameworkID.RA-P4
- Configure default settings for high privacy and safety.NIST Privacy FrameworkGV.PO-P2
- Avoid dark patterns and profiling of minors.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text. Also read by: NetChoice, LLC v. Bonta, No. 25-2366 (9th Cir. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties up to $2,500 per affected child for a negligent violation and up to $7,500 for an intentional violation.
Who enforces it
Enforcement body
California Attorney General
Litigation
- Court
- U.S. Court of Appeals for the Ninth Circuit and U.S. District Court for the Northern District of California
- Docket
- 9th Cir. Nos. 23-2969 and 25-2366; N.D. Cal. No. 5:22-cv-08861-BLF
- Posture
- The data protection impact assessment requirement, data use restrictions, dark patterns restriction, and notice and cure provision remain enjoined. A Ninth Circuit ruling vacated the injunction as to the entire Act, including the coverage definition and the age estimation requirement, affirmed it only as to the data use and dark patterns restrictions, and remanded to the district court to decide whether the remaining provisions are severable.
Settledness
AB 2246 (Chapter 187, Statutes of 2026) repeals this title.
- As of
- Case link
- https://cdn.ca9.uscourts.gov/datastore/opinions/2026/03/12/25-2366.pdf
- Case citation
- NetChoice, LLC v. Bonta, No. 25-2366 (9th Cir. )
- Under challenge
- Yes
- Open questions
- Which conduct do the data use restrictions in Civil Code section 1798.99.31(b)(1) to (4) and the dark patterns restriction in section 1798.99.31(b)(7) prohibit, given the Ninth Circuit's holding that the challenged provisions do not clearly delineate the proscribed conduct?
- Which provisions of the Act remain enforceable if the district court finds on remand that the notice-and-cure provision in Civil Code section 1798.99.35(c)(2) is not volitionally severable from the rest of the Act?
What it makes you log
Who may demand the log
Regulator
Log retention
The assessment documentation is kept for as long as the service is likely to be accessed by children (1798.99.31(a)(1)(A)).
- As of
- Basis
- Purpose bound
- Prohibits retaining
- personal information collected to estimate age or age range, for any other purpose or for longer than necessary to estimate age
Logging duty
The duty is to document and keep the assessment of the service, not a log of age checks. Section 1798.99.31(a)(5) requires age estimation and names no record of it; (b)(8) limits what may be kept from it.
- Kind
- Implicit
- As of
- Provision
- Cal. Civ. Code 1798.99.31(a)(1)(A): maintain documentation of the Data Protection Impact Assessment for as long as the service is likely to be accessed by children, and review the assessments every two years; 1798.99.31(a)(4): make an assessment available to the Attorney General within five business days of a written request
- Trigger
- personal_data_processing
What this law does
Requires businesses providing an online service, product, or feature likely to be accessed by children under 18 to complete data protection impact assessments, configure default settings for high privacy and safety, and avoid dark patterns and profiling of minors. AB 2246 (Chapter 187, Statutes of 2026) repeals this title and adds a replacement title in its place.
How courts have read itPremium data
Our analysis of this law draws on 2 court rulings.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .