The California Legislature passed the nation’s first bill to protect children’s online privacy. Here’s what he does and what happens next.
Governor Gavin Newsom signed AB 2273 on September 15.
When does a child become an adult? This is an elusive question that developmental psychologists, philosophers, and parents can answer in different ways.
But legislators cannot work with ambiguity. So in the late 1990s, Congress decided that children—at least when it comes to web surfing—are people under the age of 13.
Last week, California lawmakers said no. Children are people under 18 years of age. And if Gov. Gavin Newsom signs the bill they just passed, California kids under 18 will have a lot more privacy rights online.
What young people are exposed to on apps and online has become a source of concern for parents, fueled by alarming headlines and new research. So a bipartisan group of lawmakers pushed the California Age-Responsible Design Act, also known as AB 2273. The bill, which passed unanimously in the Legislature last week, could become a model for other states or a road map for Congress considering its own privacy bill.
“Social media is something that wasn’t made for kids,” said Emily “Amy” Kim, an 18-year-old who lives in Porter Ranch, near Los Angeles.
Kim splits her time as legislative director for the Log Off Movement, a youth organization that advocated for the bill, as well as taking college classes and working at Chipotle.
This is what the bill provides
If signed into law, California companies that provide online services or products that can be accessed by children under 18 will have to provide greater privacy protections by default starting in July 2024. In particular, the draft law provides for:
- Require companies to assess the potential harms of how they use children’s data in new services or features and create a risk mitigation plan before the feature is rolled out.
- Prohibit companies from using children’s information in a way that the company knows (or has reason to know) is “materially harmful” to their well-being — such as pushing children to photos of skinny supermodels after they search for information about weight loss.
- Companies are generally prohibited from collecting, selling, sharing, or storing any personal information about a child unless it is necessary to provide services directly used by the child.
- By default, prevent companies from collecting, selling, or sharing children’s precise location data unless strictly necessary for that function, and only then for a limited time.
- Require the product to let children know when they are being watched if the company allows parents or adults to monitor children online.
If some of those requirements sound vague, the bill also creates a new task force — made up of experts in child privacy, computer science, mental health, and more — to make recommendations to the legislature.
The bill would be enforced by the state attorney general, who could bring civil lawsuits that could result in fines of up to $7,500 per child for willful violations.
Carla Garcia, the mother of an 11-year-old from the Palms neighborhood of West Los Angeles, supports the bill because she hopes it will curb the algorithms that drag her son Alessandro Greco onto YouTube. “He knows it’s an addiction,” she said of her son’s America’s Got Talent binges, which keep him from doing his homework. “Honestly, I fight with my kid every night.”
“I want him to have his independence, but this is stronger than him,” Garcia said.
How the law worked elsewhere
The idea was borrowed from the law of Great Britain, which entered into force in September 2021. After the law was passed, tech companies made changes, including:
- YouTube has disabled autoplay — the feature that plays videos continuously — for users under the age of 18.
- Google made SafeSearch standard for users under 18 and stopped tracking children’s location data.
- TikTok has stopped sending late-night push messages to teenagers. 13-15-year-olds do not receive push notifications after 21:00, and 16- and 17-year-olds do not receive push notifications after 22:00. The company has also disabled direct messages for users under the age of 16.
Who can become a child?
The bill faced pushback from lobbying groups representing technology companies and other businesses, including the California Chamber of Commerce, the Entertainment Software Association and TechNet. TechNet members include Amazon, Google, Meta (formerly known as Facebook), and Uber. The organizations argued that the bill would apply to more sites than necessary.
“This is yet another example of why we need a federal privacy law that provides universal standards for protecting children online, rather than a patchwork of state laws that create confusion and make it difficult for companies to comply,” said Dylan Hoffman, CEO of TechNet , which oversees California and the Southwest. in the application.
One of the main changes the groups pushed for was lowering the definition of a child in the bill from 18 to 13, as in federal law. At the time, they argued for 16, which is the threshold in California’s privacy law, Hoffman said. But business groups have not been successful in this push.
“Any parent, frankly, any grandparent, any sister, brother will tell you that a 13-year-old child is not an adult,” said Baroness Biban Kidron, a member of the UK House of Lords who led the effort. with passed the UK law and founded the 5Rights Foundation, which sponsored the bill in California. “You can’t ask a 13-year-old to make adult decisions,” Kidron said.
What happens next?
First, Newsom will decide whether he wants to sign the bill or veto it. If he signs it, most of the measure’s requirements would not take effect until 2024.
But companies will have to start identifying and mitigating risks to children immediately, said Nicole Rocha, director of US affairs at 5Rights. In other words, if the bill is signed into law, companies could start implementing the changes well before 2024.
What if companies don’t want to comply? Will the threat of a potential lawsuit from the California Attorney General be enough to sway them into action?
“I’m watching this very closely,” said Buffy Weeks, a Democratic state assemblywoman from Oakland and one of the bill’s sponsors. According to her, the legislature can pass another bill if it is necessary to improve the way the law is applied. “We can sit here and make policy all day, but if it’s not implemented, it’s not enforced, like, what’s the point?”
Learn more about the legislators mentioned in this article
State Assembly District 15 (Oakland)
How she voted in 2019-2020
District 15 Demography
Asm. Buffy Weeks took at least
sector, as she was elected to the legislature. It represents
her total campaign contributions.