How California AB 2273 Attempts to Protect Children Online
A rundown of what's in the bill for those who don't have time to read the whole thing.
Several attempts at regulating the internet for children have failed in the US state of California. But the state's senate just unanimously passed the California Age-Appropriate Design Code Act, aka AB 2273. The assembly had already unanimously passed it in May, and it now heads to the Governor's desk. He has not indicated whether he will sign it or not.
The US has a federal law called the Children's Online Privacy Protection Act, or COPPA, which restricts sites from collecting info from children younger than 13 and sets rules if a site is aimed specifically at children. California's AB 2273 expands that to sites "likely" to be accessed by children and raises the age from 13 to 18.
So what sites would the affect?
First, AB 2273 applies to sites that "it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children.” The indicators include that it's directed to children as defined in the federal COPPA act or marketed to children. There's reliable evidence internally or independently, that a significant number of children visit the site or it's similar to a site that is. It has child-focused features like games, cartoons, music, and celebrities who appeal to children.
The rules do not apply to telcos, broadband internet providers or physical products.
A child is anyone younger than 18.
OK. So if a site meets those indicators, what does it need to do?
It " should consider the best interests of children when designing, developing, and providing that service, product, or feature.”
“Establish the age of consumers with a reasonable level of certainty." If it does not have actual knowledge it should not collect any personal info not necessary to provide the product.
Not use a child's personal info for anything other than the reason it was collected. Including sharing or selling it. That includes geolocation. So a navigation app gets to collect location but only for the purpose of providing navigation.
Not use dark patterns to collect info, but it does not define them.
Set all default privacy settings to the most private.
Write all privacy information, terms of service, policies, and community standards in clear language suited to the age of children likely to access the service.”
Provide an “obvious signal” to the child if parents are monitoring or tracking them.
Make it easy to report privacy concerns
Do Data protection assessments, report it to the California Privacy Protection Agency and update it every two years.
Not use personal information in a way that it knows is harmful to physical or mental health.
AND finally, Not profile a child by default. Profiling basically means using personal info to predict behavior. AKA ad targeting.
Fines of up to $7500 per affected child can be levied against companies that violate the rule.
Tech Industry groups NetChoice and the CCIA are pressuring Governor Newsom to veto the bill, calling it unconstitutional. Those two groups are also challenging Texas and Florida's social media regulations in court.
The law is similar to the UK's Age Appropriate Design Code, which began being enforced last September.
If signed into law it would take effect in 2024.