**California Just Signed Four Bills to Protect Children Online. Here Is What Three of Them Require.**

Governor Newsom has signed a package of four bills into law strengthening protections for children online. The bills approach the problem from different angles: addictive design features, children's data practices, age assurance, enhanced damages, and AI chatbot regulation. This is the first of two articles breaking down what each bill requires. Part 1 covers AB 1709, AB 2246, and AB 1856.

AB 1709: Addictive design features

AB 1709 requires social media companies to show users under the age of 16 a stripped-down version of their products. Addictive feeds, autoplay, and other features designed to maximise engagement must be removed for this age group.

The bill also establishes an e-Safety Advisory Commission within the California Department of Justice. The Commission will advise the state on future digital safety policy and report to the legislature annually, building an ongoing advisory function into the enforcement structure rather than treating the legislation as a one-time intervention.

Penalties under AB 1709 reach up to $50,000 per intentional violation and $25,000 per negligent violation. The penalties collected go to the Consumer Privacy Fund. Claims can only be brought by the State of California through the Attorney General or a local public prosecutor. There is no private right of action.

AB 2246: Children's data and privacy

AB 2246 requires online services likely to be accessed by children to set all privacy settings to the highest level of protection by default. The bill limits profiling, restricts the collection of precise geolocation data, and explicitly prohibits dark patterns that encourage children to surrender personal information or give up privacy protections.

Privacy information, terms of service, and policies must be provided in a concise manner in clear language suited to the age of the child.

Penalties reach up to $5,000 per negligent violation and $15,000 per intentional violation. The penalties go to the Consumer Privacy Fund and claims can only be brought by the Attorney General. There is no private right of action.

AB 1856: Age assurance

AB 1856 expands the age-bracketing framework established by last year's AB 1043. That framework is set to come into force in January 2027. AB 1856 clarifies that it applies only to operating systems with an account setup feature and to the primary user of a shared device.

Under the framework, developers can request to know whether a user falls into one of four age brackets: under 13, 13 to 16, 16 to 18, or above 18. The request must use the minimum amount of information necessary to determine the bracket. Following opposition from privacy advocates, the bill was amended to exempt open-source developers from the age-signalling framework.

Fines under AB 1856 reach $2,500 per negligent violation and $7,500 per intentional violation. Claims can only be brought by the Attorney General. There is no private right of action.

What these three bills have in common

All three bills were added as sections of the California Business and Professions Code and direct enforcement through the Attorney General rather than creating a private right of action. The bills target design and data practices rather than the content platforms host.

AB 1709 targets the features themselves. AB 2246 targets the data practices and interface choices that surround children's use of those features. AB 1856 provides the age assurance infrastructure that makes age-differentiated protections enforceable in practice.

Part 2 covers AB 2, which allows parents to seek up to $1 million in enhanced damages from large social media companies for negligently harming children, and Adam's Law, which establishes the most comprehensive digital protections for children interacting with AI companion chatbots in the United States.

Fairpatterns detects the addictive design features and dark patterns these bills target automatically, across platforms and at scale.

‍