California Congress passed the Age-Appropriate Design Code Act

Monday, February 27th, 2023

The California Congress approved a Bill that requires business that provide online services, products or features likely to be accessed by children to comply with specific actions aimed at protecting the privacy, safety, and well-being of children. The Bill is entitled Age-Appropriate Design Code Act and is aimed at any person under 18 years old.

Among other things, the Bill requires companies to complete a Data Protection Impact Assessment (DPIA) for any online service, product or feature likely to be accessed by children. The DPIA must also be biennially reviewed.

Based on the DPIA, companies must create a timed plan to mitigate or eliminate any risk of material detriment to children that arises from data management practices, and the DPIAs must be submitted within 3 business days from a written request to California’s Attorney General.

Companies must also configure all default privacy settings provided to children to a higher level of privacy, and provide any privacy information, terms of service, policies, and community standards in a clear language suited to the age of children likely to access that online service, product, or feature.

The Bill must be signed by California’s Governor, and, if signed into law, its rules would take into effect in 2024.