An act to add Chapter 22.1.5 (commencing with Section 22583) to Division 8 of the Business and Professions Code, relating to business.
AB 2246 would create a new chapter in the Business and Professions Code governing online services, products, and features that are likely to be accessed by children. It requires covered businesses to estimate users’ ages with reasonable certainty or apply children’s privacy protections to all users, set default privacy settings to a high level of privacy, present privacy policies and terms in clear child-appropriate language, provide notice when a child is being monitored or tracked, and offer accessible tools for children and parents to exercise privacy rights and report concerns.
The bill also prohibits a covered business from using children’s personal information in ways that could cause significant mental suffering or discrimination, profiling a child by default, collecting or retaining unnecessary personal information, using children’s data for purposes other than those for which it was collected, collecting or sharing precise geolocation by default, using dark patterns to push children to give up privacy protections, or reusing age-estimation data for other purposes. It expressly states that it does not require a business to block children from accessing media, and it excludes broadband internet access services, telecommunications services, physical products, and certain information or entities already exempted under the Civil Code.
AB 2246 would add a standalone statutory framework in the Business and Professions Code that closely tracks, and in some respects strengthens, California’s existing child online privacy protections. It would expand obligations for businesses offering online services likely to be accessed by children, increase compliance duties around age assurance, default privacy settings, disclosure, monitoring notices, and geolocation handling, and authorize the Attorney General to enforce the law through injunctions and civil penalties. The bill also directs recovered penalties to the Consumer Privacy Fund and bars private rights of action, keeping enforcement in the hands of the state.
The available voting history suggests broad support and little visible opposition. The bill advanced out of committee unanimously, including a 13-0 vote to do pass and re-refer, followed by an 11-0 vote to do pass as amended and re-refer to Appropriations. No committee transcript was provided, but the unanimous votes indicate a generally favorable view of the bill’s child privacy and online safety goals.
The main policy tension appears to be between stronger child privacy protections and the operational burden on online businesses. The bill requires age estimation or universal application of child protections, limits data collection and retention, and restricts profiling and geolocation practices, which may raise implementation and compliance concerns for platforms that serve mixed-age audiences. Another possible point of contention is that the bill removes certain exceptions referenced in existing law, suggesting a stricter approach than current child-design requirements. However, the recorded votes do not show significant committee disagreement.