CA AB 2246
California Assembly Bill 2246 - Online Service, Product, or Feature: Access by Children
Repeals and replaces the California Age-Appropriate Design Code Act. Requires a business providing an online service, product or feature likely to be accessed by children to estimate the age of child users with a reasonable level of certainty or extend child protections to all users, to configure high-privacy defaults, and to take reasonable steps to prevent specified harms including severe psychological harm. Removes the exceptions to the data-collection prohibitions, lets children void contracts entered through manipulative design features, and states that it creates no private right of action.
Jurisdiction
California
Enacted
Sep 10, 2026
Effective
Jan 1, 2027
Enforcement
California Attorney General or a public prosecutor, by civil action; penalties recovered by the Attorney General are deposited in the Consumer Privacy Fund
Approved by Governor Newsom and filed with the Secretary of State on September 10, 2026 as Chapter 187, Statutes of 2026. Repeals Civil Code Title 1.81.47 (commencing with Section 1798.99.28), the California Age-Appropriate Design Code Act of 2022, and re-enacts a replacement title in its place. No urgency clause, so it takes effect January 1, 2027 under Article IV, Section 8(c) of the California Constitution. The 2022 act it replaces has been enjoined since September 2023 and its Ninth Circuit appeal was still pending when this act was signed; that litigation history is recorded on us-ca-aadc.
California Legislative Information: AB 2246, Chapter 187, Statutes of 2026 (chaptered text)Why It Matters
Second attempt at a California design code written against a specific judicial holding: the impact-assessment mandate that failed strict scrutiny is gone, and the remaining duties are framed as harm prevention and data practice rules rather than as documentation and reporting. The named duty to take reasonable steps to prevent severe psychological harm to children is the clause that reaches conversational products, and no court has yet tested it.
Recent Developments
Signed September 10, 2026 as Chapter 187, Statutes of 2026, replacing an act that has been enjoined on First Amendment grounds since September 2023. The replacement drops the data protection impact assessment that the district court found likely to be unconstitutional compelled speech, which is the central change from the 2022 text, and substitutes an outcome-framed duty to take reasonable steps to prevent specified harms. It also removes the exceptions that had qualified the data-collection prohibitions and forecloses private enforcement.
At a Glance
Applies to
Harms addressed
Who Must Comply
- Businesses providing an online service, product or feature likely to be accessed by children under 18 years of age
Obligations fall on:
Applicability thresholds:
Safety Provisions
- Duty to take reasonable steps to prevent physical harm, financial harm, severe psychological harm, intrusions on privacy, and discriminatory treatment of children
- Estimate the age of child users with a reasonable level of certainty, or apply child protections to all users
- Default privacy settings configured to a high level of privacy
- Age-appropriate terms, policies and community standards, clearly presented
- Signal to the child when a parent, guardian or other adult is monitoring the child or tracking location
- Accessible privacy tools and a mechanism to report harm or concerns
- Prohibits profiling a child by default absent safeguards, collecting personal information beyond what is necessary, using collected information for unrelated purposes, and collecting precise geolocation by default
- Prohibits dark patterns that steer children into weaker privacy choices
- Allows a child to void a contract entered into as a result of a manipulative design feature
Compliance & Enforcement
Key Dates
Jan 1, 2027
Replacement title takes effect and the 2022 Age-Appropriate Design Code Act is repealed
Penalties
$15K; $15K/violation
View on map
California
Focus Areas
Cite This
APA
California. (2026). California Assembly Bill 2246 - Online Service, Product, or Feature: Access by Children.
Related Regulations
CA AB 1709
Prohibits a covered platform from providing an addictive feature to a user under 16 years of age and requires reasonable measures to ensure that under-16 users are not provided one. Establishes the e-Safety Advisory Commission within the Department of Justice as an independent advisory body reporting annually to the Legislature and the Governor, and authorises the Attorney General to adopt regulations expanding the definition of covered platform.
CA AB 2
Requires a social media platform with more than $100 million in annual gross revenues to exercise ordinary care or skill in its interactions with minors, and makes it liable in damages for injury to a child caused by a failure to do so. Provides statutory damages of $5,000 per violation capped at $1 million per child, or treble actual damages, whichever is greater, and voids any waiver of the liability. Repealed January 1, 2035.
IL HB 5511
Requires covered operators of online platforms to apply protective default settings to users they know to be minors, including limits on algorithmic feeds, a 10 p.m. to 7 a.m. notification curfew and no autoplay by default on addictive social media platforms, and establishes a device-level age-bracket signal that Internet-enabled device manufacturers must provide and operators must request. Announced by the Governor as the Children's Social Media Safety Act, the title of the bill as introduced. Enforced by the Attorney General.
IA SF 2417
Establishes requirements and guidelines for conversational AI services including AI disclosure to minors, prohibition on sexually explicit content for minors, prevention of deceptive human-like interactions, and parental controls for children under 13.
CO HB 1263
Imposes obligations on conversational AI service operators including minor-user protections, suicide and self-harm protocols, prohibition on emotional dependence and engagement gamification, and annual safeguard reporting.
Finland AI Act
Finland's EU AI Act implementation using decentralized supervision model. Traficom serves as single point of contact and coordination authority. Ten market surveillance authorities share enforcement across sectors. New Sanctions Board handles fines over EUR 100,000.
Last updated September 13, 2026. Verify against primary sources before relying on this information.