CAADCA Section 1798.99.31(a)(7) - Default Privacy Settings
Configure all default privacy settings for children to the highest privacy level unless a compelling best-interests reason justifies a different default
Where this comes from
Provision: Section 1798.99.31(a)(7) - Default Privacy Settings
Instrument: California Age-Appropriate Design Code Act (AB 2273)
Citation: Cal. Civ. Code § 1798.99.31(a)(7), California Age-Appropriate Design Code Act (AB 2273)
Text version: California Age-Appropriate Design Code Act, AB-2273 (2022); Cal. Civ. Code §§ 1798.99.28–1798.99.40
Who it applies to
CAADCA scope (designed for OR likely accessed by children) — any one of these:
- Service is specifically designed for children under 18
- Service is likely to be accessed by children under 18
…unless:
- Settings that protect child safety may be enabled by default even if they involve data processing. (Cal. Civ. Code § 1798.99.31(b)(1))
Scope in the source's own terms
- Service has child users
- Service available to California residents
What engineering work it implies
Sample acceptance criteria Landfall generates for this obligation:
- Default profile visibility: private (not public)
- Default data sharing: off (opt-in, not opt-out)
- Default location tracking: off
- Default contact discoverability: off
- User can change any default via settings
Evidence an auditor expects
- Technical controlTechnical audit
Privacy default configuration
Technical documentation showing all privacy settings default to highest protection for child users
- User-interface evidenceUser testing
Default settings screenshots
UI evidence showing default privacy configuration for new child accounts
Questions people ask
- Does CAADCA Section 1798.99.31(a)(7) - Default Privacy Settings apply to my service?
- It applies when at least one of: Service is specifically designed for children under 18; Service is likely to be accessed by children under 18. It does not apply where Settings that protect child safety may be enabled by default even if they involve data processing. (Cal. Civ. Code § 1798.99.31(b)(1)).
- From when does this apply?
- CAADCA Section 1798.99.31(a)(7) - Default Privacy Settings applies from 1 July 2024. Its current status is: in force.
- What evidence does an auditor expect?
- Privacy default configuration; Default settings screenshots.
Find out whether this one lands on you
Landfall's pre-scan answers the applicability question above for your product in minutes, then turns every obligation that applies into traceable engineering tickets with a citation chain your auditors can follow.
Not legal advice. Landfall maps regulatory obligations to engineering work for planning purposes. Its verdicts are not legal advice and create no attorney-client relationship — verify with qualified counsel before relying on them.