Protecting children online appears to begin with a simple question: Is the user a child?

Answering that question, however, may require an online service to collect or analyze information about the person seeking access. A measure intended to protect children’s privacy can therefore create a privacy concern of its own.

California’s newly enacted Assembly Bill 2246 brings that tension into focus. Signed on September 10, 2026, the law repeals and replaces the California Age-Appropriate Design Code Act while restoring many of its substantive protections. It applies to businesses offering online services, products, or features likely to be accessed by children, defined as consumers under 18 years of age.

The law is scheduled to take effect on January 1, 2027.

Determining Who Is a Child

AB 2246 requires covered businesses to estimate users’ ages with reasonable certainty appropriate to the risks created by their data practices. A business can avoid making individual age determinations by applying children’s privacy protections to every consumer.

Each approach raises practical questions.

Age estimation may involve account information, behavioral signals, identity documents, facial analysis, third-party verification, or other indicators. Some methods may be relatively limited, while others could require information that users would not ordinarily expect to provide simply to visit a website or use an application.

Applying children’s protections to everyone could reduce the need for age estimation, but it may also change the experience offered to adults. Businesses may decide that identifying younger users is preferable to redesigning their services for the entire audience.

The result is a difficult choice. Should a service collect more information to determine who requires protection, or should it provide the highest level of protection without first distinguishing among its users?

Privacy by Default

Once a user is identified as a child, the law requires covered businesses to configure default settings to provide a high level of privacy. Privacy information, terms of service, policies, and community standards must also be presented prominently and in language suited to the ages of the children likely to use the service.

The law limits profiling by default unless safeguards are in place and the profiling is necessary for the service in which the child is actively engaged or advances the child’s safety, privacy, or education. It also restricts the collection, sale, or sharing of a child’s precise geolocation unless that information is strictly necessary to provide the requested service.

When precise location is being collected, the child must receive an obvious signal for the duration of that collection. A similar notice is required when a parent, guardian, or another person uses the service to monitor the child’s online activity or track the child’s location.

These requirements recognize that surveillance does not become invisible merely because it is conducted for protection. Children are given notice that monitoring is occurring, even when an adult may have authorized it.

Design as a Privacy Issue

AB 2246 also addresses how online services influence children’s choices.

Covered businesses may not use dark patterns to encourage children to surrender more personal information than reasonably expected or to give up privacy protections. Information collected to estimate age cannot be retained longer than necessary or repurposed for unrelated uses.

The law goes further by allowing a child to void a contractual provision entered into by the child, parent, or guardian when the agreement resulted from a design feature of a covered service.

This provision treats interface design as more than presentation. A button, prompt, notification, or sequence of choices can affect whether consent reflects an informed decision or a strategically engineered response.

For children, whose ability to understand long-term consequences continues to develop, the distinction may be especially important.

Preventing Foreseeable Harm

Covered businesses must take reasonable steps to prevent several categories of reasonably foreseeable harm. These include physical or financial harm, severe psychological or emotional harm, highly offensive intrusions into legally protected privacy rights, and unlawful discrimination.

At the same time, the law states that this obligation should not be interpreted as requiring businesses to monitor or remove third-party content, restrict lawful speech, or produce a particular recommendation or editorial outcome.

That boundary reflects a recurring problem in online safety law. Legislators may seek to reduce harm without turning privacy protections into a general mandate to observe everything users say and do.

Protection Through Greater Knowledge?

AB 2246 presents privacy as both an objective and an operational challenge.

Businesses must know enough about their users to recognize children, but they are also expected to minimize what they collect. Parents may be permitted to monitor a child, but the child must be told when that monitoring occurs. Services may personalize an experience, but profiling cannot become the automatic condition of participation. Design can help protect children, but it can also manipulate them.

The law offers businesses an alternative to individual age estimation: provide children’s privacy protections to everyone. Whether businesses widely adopt that approach may reveal how much online personalization and data collection depend on distinguishing one category of user from another.

Protecting children online is an important objective. The unresolved question is whether age assurance can accomplish that objective without creating a broader system of identity verification and user surveillance.

Can an online service determine who is a child while learning as little as possible about everyone else?

References

California Legislature. (2026). Assembly Bill No. 2246: Online service, product, or feature: access by children.

Office of Governor Gavin Newsom. (2026, September 10). Governor Newsom signs the strongest child safety chatbot and social media laws in the nation.