Law / United States / 
Michigan
SB 758 (2026), Michigan Kids Code Act
Senate Bill 758, 2025-2026 Regular Session
Before the second chamber, dated , as of .
An age-appropriate design code rule binding private bodies.
- Enforcement body
- Michigan Attorney General
- Age threshold
- 18
- Covered services
- Covered online service providers reasonably likely to be accessed by a covered minor.
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Verification methods
- Self declaration
- Audit expectation
- periodic
- Who audits it
- Independent third party
- Where the report goes
- Published
Where it has got to
The text described here is Senate Bill 758 as passed by the Senate, substitute S-2. That print is SB 758 (S-2), published .
Locally, this stage is House Committee on Communications and Technology.
The stage above is recorded at www.legislature.mi.gov.
Passed the Senate 20 to 17 on (roll call 64) and referred to the House Committee on Communications and Technology the same day, with no House action recorded since. Tie-barred to Senate Bill 759.
What it requires
- The enacting sections of this bill provide that it does not take effect unless Senate Bill No. 759 of the 103rd Legislature is enacted into law.
- If your online service is reasonably likely to be accessed by a covered minor, give a parent tools to manage the minor's privacy and account settings, screen time, and purchases.NIST Privacy FrameworkCT.PO-P3
- Collect only the personal data a covered minor needs for the service.NIST Privacy FrameworkGV.PO-P1
- Do not use profiling, dark patterns, or personalized-feed recommendations directed at a covered minor absent the minor's own request.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P1Organizational privacy values and policies (e.g., conditions on data processing such as data uses or retention periods, individuals’ prerogatives with respect to data processing) are established and communicated.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
Applies beginning under the bill's own effective-date clause; the Act does not take effect at all unless Senate Bill 759 is also enacted into law.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 50,000
What it makes you log
Who may demand the log
Auditor or notified body
Log retention
Section 11(2): the provider is not required to collect personal data to comply, must not use age-verification data for any other purpose, and must delete it immediately after using it for age verification. Section 11(1) also limits processing or retaining minors' data to the minimum necessary.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data collected for age verification, after it has been used for age verification
Logging duty
The annual public report in section 17(1) must state, among other things, the number and types of harm reports received under section 15 and the average daily time minors spend on the service at stated percentiles, which a provider cannot produce without keeping records. The bill does not use the word log or record and requires no record of an age check: section 11(2) instead requires age-verification data to be deleted immediately after use.
- Kind
- Implicit
- As of
- Provision
- Senate Bill 758 (substitute as passed by the Senate), section 17(1)
- Trigger
- personal_data_processing
What this law does
Would require a covered online service provider to give a parent tools to manage a covered minor's privacy and account settings, screen time, and purchases, to collect only the personal data a covered minor needs for the service, and to bar profiling, dark patterns, and personalized-feed recommendations directed at a covered minor absent the minor's own request.
Does not take effect unless Senate Bill 759 is also enacted; passed the Senate 20 to 17 on and is pending in the House Committee on Communications and Technology.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .