Internet privacy law for children would prohibit tracking

In summary

A first national bill that would protect children’s privacy online has passed the California Legislature. Here’s what it does and what happens next.

Governor Gavin Newsom signed AB 2273 on September 15.

When does a child become an adult? It’s an elusive question that developmental psychologists, philosophers, and parents might answer differently.

But lawmakers cannot work with ambiguity. So in the late 90’s, Congress has decided that β€” at least when it comes to surfing the web β€” kids are people under 13.

Last week, California lawmakers said: No. Children are people under 18. And if Gov. Gavin Newsom signs a bill they just passed, kids under 18 in California will get a lot more online privacy rights.

What young people encounter on apps and the web has become a growing concern for parentsfed by alarming headlines And new research. So a bipartisan group of lawmakers pushed through the California Age-Appropriate Design Code Act, aka AB 2273. Passed unanimously by the legislature last week, the bill could become a model for other states or provide a roadmap for Congress, which is considering your own privacy law.

“Social media is something that wasn’t designed with children in mind,” said Emily “Emi” Kim, an 18-year-old who lives in Porter Ranch near Los Angeles.

Kim divides her time as legislative director for Log Off Movement, a youth-led organization that supported the bill, while also attending college classes and working at Chipotle.

Here’s what the bill would do

If it becomes law, California companies that provide online services or products that children under 18 may access should provide enhanced privacy protections by default beginning in July 2024. Specifically, the bill would:

  • Require companies to assess the potential harms in how they use children’s data in new services or features and create a plan to mitigate the risk before the feature is rolled out.
  • Prohibiting companies from using information about children in a way that the company knows (or has reason to know) is “materially harmful” to their well-being, like driving children to see photos of skinny supermodels after looking up information about weight loss.
  • It generally prohibits companies from collecting, selling, sharing or retaining any personal information about a child, unless it is necessary to provide the service that the child is directly using.
  • Prevent companies from collecting, selling, or sharing precise location data about children by default, unless strictly necessary for the feature, and only then for a limited time.
  • Require the product to make it obvious to children when they are being monitored, if the company allows parents or adults to monitor children online.

If some of these requirements seem vague, the bill also creates a new working group, made up of experts in children’s data privacy, information technology, mental health and more, to make recommendations to the lawmaker.

The bill would be enforced by the state attorney general, who could bring civil lawsuits that could carry penalties of up to $7,500 per child for intentional violations.

Karla Garcia, a parent of an 11-year-old boy in the Palms neighborhood of west Los Angeles, supports the bill because she hopes it will rein in the algorithms sucking her son, Alessandro Greco, into YouTube. “She knows it’s an addiction,” she said of her son’s America’s Got Talent binges, which keep him from doing his homework. “Honestly, I fight every night with my son.”

“I want him to have his independence, but this is stronger than him,” Garcia said.

How the law worked elsewhere

The idea was borrowed from a UK lawwhich went into effect in September 2021. Since the passage of the law, technology companies have made changes, including:

  • YouTube has disabled autoplay, the feature that plays videos continuously, for users under the age of 18.
  • Google made SafeSearch the default for users under the age of 18 and stopped tracking children’s location data.
  • TikTok has stopped sending push notifications to teens late at night. Teens aged 13-15 don’t receive push notifications after 9:00pm, and teens aged 16-17 don’t receive push notifications after 10:00pm. The company has also disabled direct messages for users under 16.

Who becomes a child?

The bill was rejected by lobbying organizations representing technology companies and other businesses, including the California Chamber of Commerce, the Entertainment Software Association and TechNet. TechNet counts Amazon, Google, Meta (formerly known as Facebook), and Uber among its members. The organizations discussed that the bill would apply to more sites than necessary.

“It’s another example of why we need a federal privacy law that includes universal standards to keep children safe online instead of a patchwork of state laws that creates confusion and compliance complications for companies,” said Dylan Hoffman, executive director of TechNet which oversees California and the Southwest, in a statement.

β€œHe knows it’s an addiction. Honestly, I fight every night with my son.

Karla Garcia, parent of an 11-year-old boy in Los Angeles

One of the major changes the groups pushed for was lowering the bill’s definition of a child 18 to 13, as in federal law. Then they argued for 16, which is a threshold in a California privacy law, Hoffman said. But corporate groups have not been successful in that push.

“Any parent, to be honest, any grandparent, any sister, any brother, would tell you that a 13-year-old is not an adult,” said Baroness Beeban Kidron, a member of the UK House of Lords who led the effort to approve the law of the United Kingdom and establishes the 5Rights Foundation, which sponsored the California bill. “You can’t ask a 13-year-old to make adult decisions,” Kidron said.

What happens next?

First, Newsom will decide whether he wants to sign the bill or veto it. If he signs it, most of the measure’s requirements won’t go into effect until 2024.

But companies should start identifying and mitigating the risks to children immediately, said Nichole Rocha, head of US affairs at the 5Rights Foundation. In other words, if the bill becomes law, companies could start implementing the changes well before 2024.

What if companies don’t want to comply? Would the threat of a potential lawsuit from the California Attorney General be enough to spur them to action?

“I’m going to be following it very closely,” said Buffy Wicks, a Democratic state assemblywoman from Oakland and one of the bill’s authors. The legislature could pass another bill if the way the law is enforced needs to be refined, she said. “We can sit here and make policies all day, but if they’re not implemented, they’re not enforced, in a sense, what’s the point?”

Learn more about the lawmakers mentioned in this story

State Assembly, District 15 (Oakland)

As voted 2019-2020

Liberal
Conservative

Demographics of District 15

Race/Ethnicity

Latin

24%

White

39%

Asian

20%

Black

12%

Multi breed

5%

Voter Registration

To the

70%

GOP extension

6%

No party

21%

Other

3%

Campaign Contributions

Asm. Buffy Wicks took at least
$720,000
from the Hard and tiring work
sector since she was elected to the legislature. Which represents
24%
of his total campaign contributions.