California Age-Appropriate Design Code Act

CAADCA applies to any business offering online services, products, or features likely to be accessed by children under 18 in California

Section 1798.99.28 - Definitions and Scope · Read the full page →

Defines which businesses fall under CAADCA based on revenue thresholds, data volume, and whether services are likely to attract children

Section 1798.99.29 - Covered Businesses · Read the full page →

CAADCA exempts HIPAA-covered entities, financial institutions under Gramm-Leach-Bliley, and insurance organizations from its requirements

Section 1798.99.30 - Exceptions · Read the full page →

Notify parents or guardians when the business has actual knowledge that a child is at risk of material detrimental effects, while maintaining child confidentiality

Section 1798.99.31(a)(10) - Parental Notification · Read the full page →

Provide prominent, accessible, and responsive tools for children and parents to exercise privacy rights and report concerns

Section 1798.99.31(a)(9) - Online Safety Tools · Read the full page →

Businesses must consider children's best interests — including physical, mental, and emotional well-being — throughout the design, development, and provision of services likely accessed by children

Section 1798.99.31(a) - Best Interests of Children · Read the full page →

Businesses must not collect, sell, share, or retain children's personal information beyond what is necessary to provide the service unless a compelling child-welfare reason exists

Section 1798.99.31(a)(3)(A) - Data Collection Limitations · Read the full page →

Prohibit use of children's personal information in ways materially detrimental to their physical health, mental health, or well-being

Section 1798.99.31(a)(4) - Detrimental Use · Read the full page →

Complete a Data Protection Impact Assessment before offering any new online service, product, or feature likely to be accessed by children

Section 1798.99.31(a)(1) - Data Protection Impact Assessment · Read the full page →

DPIAs must address specific risks including harmful content, contacts, conduct, algorithmic harm, targeted advertising harm, and privacy erosion for children

Section 1798.99.31(a)(2) - DPIA Required Contents · Read the full page →

Maintain DPIA documentation for the life of the service, make it available to the Attorney General within 5 business days on request, and review biennially

Section 1798.99.31(a)(4) - DPIA Records and Availability · Read the full page →

Businesses must not use dark patterns, manipulative design, or nudge techniques to lead children into weakening privacy settings or providing unnecessary personal information

Section 1798.99.31(a)(5)(B) - Prohibition of Nudge Techniques · Read the full page →

Create a timed plan to mitigate or eliminate identified risks to children before the service is accessed by children

Section 1798.99.31(a)(3) - Risk Mitigation · Read the full page →

Prohibit collection, sale, sharing, or retention of children's personal information beyond what is necessary for the service the child actively uses

Section 1798.99.31(a)(3) - Data Minimization · Read the full page →

Do not retain children's personal information longer than reasonably necessary for the actively used service; do not repurpose previously collected data without a compelling best-interests justification

Section 1798.99.31(a)(3) - Data Retention Limits · Read the full page →

Do not collect or use precise geolocation of children by default; allow only when strictly necessary and for the minimum time required

Section 1798.99.31(a)(4) - Geolocation · Read the full page →

Prohibit dark patterns that lead children to over-share data, forego privacy, or take actions detrimental to their well-being

Section 1798.99.31(a)(5) - Dark Patterns · Read the full page →

Profiling of children is prohibited by default unless necessary for the actively used feature with safeguards, or demonstrably in children's best interests

Section 1798.99.31(a)(6) - Profiling by Default · Read the full page →

Configure all default privacy settings for children to the highest privacy level unless a compelling best-interests reason justifies a different default

Section 1798.99.31(a)(7) - Default Privacy Settings · Read the full page →

Provide all privacy information, terms, policies, and community standards in concise, prominent, and age-appropriate language

Section 1798.99.31(a)(8) - Transparency · Read the full page →

Provide an obvious and accessible mechanism for children to report concerns about their privacy and well-being

Section 1798.99.31(a)(9) - Reporting Mechanisms · Read the full page →

Estimate the age of child users with reasonable certainty proportionate to risk, or apply children's protections to all users

Section 1798.99.31(b) - Age Estimation · Read the full page →

Platforms must provide prominent privacy tools for children and parents and configure default privacy settings to the highest level of protection

Section 1798.99.32 - Platform Duties · Read the full page →

The California Attorney General has exclusive enforcement authority over CAADCA, with civil penalties of up to $2,500 per child per negligent violation and $7,500 per child per intentional violation

Section 1798.99.33 - Attorney General Enforcement Authority · Read the full page →

The AG must publish annual enforcement reports covering complaints, investigations, enforcement actions, and penalties under CAADCA

Section 1798.99.34 - Attorney General Reporting · Read the full page →

Violations carry civil penalties of up to $2,500 per child per negligent violation or $7,500 per child per intentional violation, enforceable only by the California Attorney General

Section 1798.99.35 - Enforcement · Read the full page →

CAADCA supplements CCPA/CPRA and COPPA — businesses must comply with all applicable statutes simultaneously, not treat them as alternatives

Section 1798.99.36 - Interaction with Other Laws · Read the full page →