This law is officially called the California Age-Appropriate Design Code Act. It sets guidelines around designing products or services with children in mind.

This law emphasizes that children deserve protection when using online services, even if those services aren't specifically for them. Companies should design online products with kids' best interests in mind. If a company's business goals clash with what's best for kids, they must prioritize kids' privacy and safety over making money.

This law defines key terms for understanding the rules around children's data protection online in California. A 'child' is anyone under 18. Businesses must conduct a 'Data Protection Impact Assessment' to evaluate and manage risks to children who might use their online services or products. 'Likely to be accessed by children' means it's reasonable to expect kids will access the online features based on various indicators, like targeted advertisements or design elements. Definitions exclude broadband and telecommunications as 'online services, products, or features'. Finally, 'profiling' is using automated processing of personal data to evaluate personal traits.

This law requires businesses providing online services or products likely accessed by children to conduct a Data Protection Impact Assessment (DPIA) before launching new features. They must evaluate potential risks to children's data and maintain extensive documentation. Businesses should adjust default privacy settings to high privacy, provide clear information in age-appropriate language, and signal when children are monitored. The law prohibits actions like using discriminatory data practices, profiling without protection, and collecting unnecessary information. Businesses also need to avoid tactics encouraging children to share extra details. The law will be effective starting July 1, 2024.

The California Children’s Data Protection Working Group is set up to recommend best practices for protecting children's data. It includes experts in areas such as children’s privacy, health, computer science, and rights. The group, formed by nine appointees from various state offices, will gather input from diverse stakeholders to address how online services affect children. By July 1, 2024, and every two years after, they will report to the Legislature on identifying services accessed by kids, prioritizing children's well-being, ensuring minimal invasive age checks, and more. Meetings can be held remotely, and while members aren't paid, they are reimbursed for expenses. This section is set to expire on January 1, 2030.

This law requires businesses to conduct a Data Protection Impact Assessment by July 1, 2024, for any online service, product, or feature that children are likely to use and which is available to the public before this date. If the service, product, or feature is not available to the public after July 1, 2024, this requirement doesn't apply.

If a business breaks this law, the state can take it to court and demand financial penalties. For each child affected by a negligent violation, the penalty can be up to $2,500, and for intentional violations, it can reach up to $7,500. All money collected is used to cover the Attorney General's costs. The Attorney General must notify businesses of any issues before suing, giving them 90 days to fix things without paying penalties if they resolve everything. This law doesn't allow individuals to sue on their own, but the Attorney General can involve the public and make rules to help everyone understand the law better.

This rule doesn't apply to certain types of information or organizations that are specified in another section, specifically in subdivision (c) of Section 1798.145.