Law / United States / 
California
SB 976 (2024), Protecting Our Kids from Social Media Addiction Act
Cal. Health & Safety Code §§ 27000-27007
In force since partly blocked by a court, under challenge in court.
A social media and minors rule binding private bodies.
- Age threshold
- 18
- Covered services
- Social media platforms as defined in Business and Professions Code Section 22675.
- How the hook was established
- express
- What makes it apply
- User location
- Verification methods
- Third party service, Self declaration
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Applies to social media platforms as defined in Business and Professions Code Section 22675, in relation to users the platform knows are minors.
- Do not give a user you know is a minor an addictive feed or non default privacy settings without verifiable parental consent.
- A separate age verification requirement is not effective until .
- The Ninth Circuit found on that the default setting limiting a minor's ability to view like counts and other feedback likely violates the First Amendment and ordered the district court to enjoin it; it affirmed denial of an injunction for most other provisions.
- A federal district court enjoined California on from enforcing the limits on notifications to minors and the annual disclosure of minor user numbers (sections 27002(a), 27002(b)(1) and 27005), and California did not appeal that part of the ruling.
These lines are LexLint's reading of the law's text. Also read by: NetChoice, LLC v. Bonta, No. 25-146 (9th Cir. ) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforced only in a civil action brought by the Attorney General; the statute does not set a fixed per violation amount.
Who enforces it
Enforcement body
California Attorney General
Litigation
- Court
- U.S. Court of Appeals for the Ninth Circuit
- Docket
- 9th Cir. No. 25-146; N.D. Cal. No. 5:24-cv-07885-EJD
- Posture
- A ruling affirmed denial of an injunction as to most provisions but ordered the district court to enjoin the default setting that limits a minor's ability to view the number of likes or other feedback on posts, finding that provision likely violates the First Amendment. The age verification requirement's challenge was found unripe because it does not start until 2027. A separate district court order enjoined the limits on notifications to minors and the annual disclosure requirement, and California did not appeal that part of the ruling. On the Northern District of California denied separate preliminary injunction motions by Meta, TikTok and YouTube against the personalized feed provisions.
Settledness
The Attorney General noticed proposed regulations on age assurance and parental consent on , and was reviewing public comments on them.
- As of
- Case link
- https://cdn.ca9.uscourts.gov/datastore/opinions/2025/09/09/25-146.pdf
- Case citation
- NetChoice, LLC v. Bonta, No. 25-146 (9th Cir. )
- Under challenge
- Yes
- Open questions
- What must an operator show to have 'reasonably determined that the user is not a minor' under Health and Safety Code section 27001(a)(1)(B) from , while the Attorney General's regulations on age assurance under section 27006(b) remain proposed?
- Before , does an operator that infers a user's age from the user's activity or profile data have 'actual knowledge that the user is a minor' under sections 27001(a)(1)(A) and 27002(a)(1)?
What it makes you log
What the log must hold
Age assurance result, Consent or opt-out state
Log retention
No period is stated; deletion follows the single use.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- information collected to determine a user's age or to verify parental consent, which may not be used for another purpose and is deleted immediately after it is used, except as necessary to comply with state or federal law
Logging duty
The section names no log or record; the three counts cannot be given without a record of which users are minors, which have parental consent and which have the controls enabled.
- Kind
- Implicit
- As of
- Provision
- Cal. Health & Safety Code 27005: disclose publicly each year the number of minor users, the number for whom verifiable parental consent was received, and the number for whom the 27002 controls are or are not enabled
- Trigger
- age_assurance
- consent_or_optout
What this law does
Bars addictive feeds, most nighttime and school hour notifications, and non default privacy settings for users a platform knows are minors, without verifiable parental consent. A separate age verification requirement is not effective until .
How courts have read itPremium data
Our analysis of this law draws on 1 court ruling.
What each ruling held, what it means for an app, and whether it still stands are premium data, in the Plus, Pro and Enterprise plans.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .