California Age-Appropriate Design Code Act

CAADCA applies to any business offering online services, products, or features likely to be accessed by children under 18 in California

Section 1798.99.30(b)(1) and (b)(4) - Definitions: child; likely to be accessed by children · Read the full page →

Defines which businesses fall under CAADCA based on revenue thresholds, data volume, and whether services are likely to attract children

Section 1798.99.30(a) with § 1798.140(d) - 'Business' takes the CCPA meaning; § 1798.99.29 legislative findings · Read the full page →

CAADCA does not apply to the health information and health-care entities described in Civil Code § 1798.145(c)

Section 1798.99.40 - Exceptions (incorporating § 1798.145(c)) · Read the full page →

WITHDRAWN ATTRIBUTION — not a verified statutory duty. This provision concerns tools for privacy rights and reporting concerns. It does not establish the parental-harm notification duty previously attributed to it.

Cal. Civ. Code § 1798.99.31(a)(10) · Read the full page →

Provide prominent, accessible, and responsive tools for children and parents to exercise privacy rights and report concerns

Section 1798.99.31(a)(10) - Tools to exercise privacy rights and report concerns · Read the full page →

Businesses must consider children's best interests — including physical, mental, and emotional well-being — throughout the design, development, and provision of services likely accessed by children

Section 1798.99.29(a)-(b) - Legislative findings: best interests of children (interpretive) · Read the full page →

Businesses must not collect, sell, share, or retain children's personal information beyond what is necessary to provide the service unless a compelling child-welfare reason exists

Section 1798.99.31(b)(3) - No collection, sale, sharing, or retention beyond what is necessary (enjoined) · Read the full page →

Prohibit use of children's personal information in ways materially detrimental to their physical health, mental health, or well-being

Section 1798.99.31(b)(1) - No materially detrimental use of a child's personal information (enjoined) · Read the full page →

Complete a Data Protection Impact Assessment before offering any new online service, product, or feature likely to be accessed by children

Section 1798.99.31(a)(1)(A) - Data Protection Impact Assessment before offering a new service (enjoined) · Read the full page →

Where the California statutory DPIA duty applies, assess all eight risks: harmful content; harmful contacts; witnessing, participating in or being subject to harmful conduct; exploitation by harmful contacts; algorithms; targeted advertising; engagement-extending features including autoplay, time rewards and notifications; and collection or processing of sensitive personal information.

Section 1798.99.31(a)(1)(B)(i)-(viii) - Data Protection Impact Assessment contents (enjoined) · Read the full page →

Maintain DPIA documentation for the life of the service, make it available to the Attorney General within 5 business days on request, and review biennially

Section 1798.99.31(a)(1)(A), (a)(3) and (a)(4) - DPIA documentation, list and production to the Attorney General (enjoined) · Read the full page →

WITHDRAWN ATTRIBUTION — not a verified statutory duty. There is no Cal. Civ. Code § 1798.99.31(a)(5)(B). The Act's only provision on manipulative design is § 1798.99.31(b)(7) (dark patterns), carried by CAADCA-9931A5-DARK-PATTERNS; the 'manipulate or coerce ... developmental vulnerabilities' text previously attributed to this record appears nowhere in the Act (leginfo, 2026-09-21).

Cal. Civ. Code § 1798.99.31(b)(7) — withdrawn attribution (duplicate of CAADCA-9931A5-DARK-PATTERNS) · Read the full page →

Create a timed plan to mitigate or eliminate identified risks to children before the service is accessed by children

Section 1798.99.31(a)(2) - Document risks and create a timed mitigation plan (enjoined) · Read the full page →

Do not use a child's personal information for any reason other than the reason it was collected, absent a demonstrable compelling reason in the best interests of children (enjoined)

Section 1798.99.31(b)(4) - No use of a child's personal information for another purpose (enjoined) · Read the full page →

Use personal information collected to estimate age or age range for no other purpose and keep it no longer than necessary to estimate age; make age assurance proportionate to the service's risks and data practices

Section 1798.99.31(b)(8) - Age-assurance data: no other use, no longer retention; proportionality · Read the full page →

Do not collect or use precise geolocation of children by default; allow only when strictly necessary and for the minimum time required

Section 1798.99.31(b)(5)-(6) - Precise geolocation: off by default; obvious sign while collected · Read the full page →

Prohibit dark patterns that lead children to over-share data, forego privacy, or take actions detrimental to their well-being

Section 1798.99.31(b)(7) - Dark patterns (enjoined) · Read the full page →

Profiling of children is prohibited by default unless necessary for the actively used feature with safeguards, or demonstrably in children's best interests

Section 1798.99.31(b)(2) - No profiling of a child by default (enjoined) · Read the full page →

Configure all default privacy settings for children to the highest privacy level unless a compelling best-interests reason justifies a different default

Section 1798.99.31(a)(6) - Default privacy settings offering a high level of privacy · Read the full page →

Provide all privacy information, terms, policies, and community standards in concise, prominent, and age-appropriate language

Section 1798.99.31(a)(7) - Privacy information, terms, policies and community standards in clear age-suited language · Read the full page →

Where a parent, guardian, or any other consumer can monitor a child's online activity or track the child's location, give the child an obvious signal while it is happening

Section 1798.99.31(a)(8) - Obvious signal to the child when monitored or tracked · Read the full page →

Estimate the age of child users with reasonable certainty proportionate to risk, or apply children's protections to all users

Section 1798.99.31(a)(5) - Estimate the age of child users, or apply children's protections to all consumers (remanded) · Read the full page →

Enforce the terms of service, policies, and community standards you publish, including privacy policies and those concerning children (enjoined)

Section 1798.99.31(a)(9) - Enforce published terms, policies and community standards (enjoined) · Read the full page →

The California Attorney General has exclusive enforcement authority over CAADCA, with civil penalties of up to $2,500 per child per negligent violation and $7,500 per child per intentional violation

Section 1798.99.35(a), (d), (e) - Attorney General enforcement, penalties, no private right of action · Read the full page →

WITHDRAWN ATTRIBUTION — not a verified statutory duty. There is no Cal. Civ. Code § 1798.99.34. The Act contains no annual Attorney General enforcement report; the only report is the § 1798.99.32 working group's report to the Legislature, which is not a duty on any business (enacted AB 2273, Ch. 320, and leginfo, 2026-09-21).

Cal. Civ. Code § 1798.99.34 — withdrawn attribution (section does not exist) · Read the full page →

Notice and cure: a business in substantial compliance with the DPIA requirements receives written notice before an Attorney General action and avoids civil penalties for violations cured within 90 days (cure provision enjoined)

Section 1798.99.35(c) - Notice and 90-day cure for a business in substantial compliance with the DPIA regime (enjoined in part) · Read the full page →

A DPIA prepared for another law satisfies CAADCA if it meets the title's requirements; one assessment may cover several similar processing operations only if each relevant service is addressed (enjoined with the DPIA regime)

Section 1798.99.31(c) - A DPIA conducted for another law satisfies the section if it meets the title's requirements (enjoined) · Read the full page →