California Governor Gavin Newsom on Thursday signed AB 2273, legislation designed to protect children's online privacy by demanding information from everyone.

The California Age-Appropriate Design Code Act ( [1]AB 2273 ) was modeled after [2]the UK 's age-appropriate design code.

[3]Approved last month by the State Senate, and previously by the State Assembly, the California law requires online platforms to consider the interests of children in the design of their services and to provide children with settings that default to privacy.

[4]

"We're taking aggressive action in California to protect the health and wellbeing of our kids," said Governor Newsom (D) in [5]a statement . "As a father of four, I'm familiar with the real issues our children are experiencing online, and I'm thankful to Assemblymembers Wicks and Cunningham and the tech industry for pushing these protections and putting the wellbeing of our kids first."

As a father of four, I'm familiar with the real issues our children are experiencing online

The Age-Appropriate Design Code (AADC) Act forbids online service providers that offer service to children from using the personal information of children in a way that's detrimental, from gathering, selling, or storing a child's geo-location, from profiling by default, and from soliciting children to provide their information. It also requires privacy policies and related terms be accessible and enforced.

Jim Steyer, founder and CEO of Common Sense Media, a content-rating service for patents, applauded the approval of the law.

[6]

[7]

"We recognize that this bill is just one step in a long-term effort to protect kids online," said Steyer in an emailed statement. "But it is a very important step, and time is of the essence – we must continue the momentum to expand platform accountability and online protections for children across California and the rest of the country."

While there's general agreement that children could be better protected online, the approach called for under AB 2273 would require that covered websites – those that could be used by minors – somehow verify the age of visitors. Despite Newsom's nod to ostensible tech industry support, technology rights advocates dislike the age-checking mandate, claiming it will expand surveillance in the name of privacy.

[8]

"The bill is so vaguely and broadly written that it will almost certainly lead to widespread use of invasive age verification techniques that subject children (and everyone else) to more surveillance while claiming to protect their privacy," said Fight the Future, in [9]a statement .

"...Requiring age verification also makes it nearly impossible to use online services anonymously, which threatens freedom of expression, particularly for marginalized communities, human rights activists, whistleblowers, and journalists."

[10]Via Twitter , Evan Greer, director of Fight the Future, characterized AB 2273, and AB 587, a related state social media law [11]signed earlier this week, as unconstitutional messes.

[12]

Santa Clara University School of Law professor Eric Goldman has also [13]written [14]extensively about the [15]shortcomings of the AADC.

The AADC delivers a 'hidden' payload of several radical policy ideas that sailed through the legislature without proper scrutiny

In [16]a blog post on Thursday, he wrote, "Despite its purported goal of helping children, the AADC delivers a 'hidden' payload of several radical policy ideas that sailed through the legislature without proper scrutiny.

"Given the bill’s highly experimental nature, there’s a high chance it won’t work the way its supporters think – with potentially significant detrimental consequences for all of us, including the California children that the bill purports to protect."

Specifically, Goldman argues the bill does away with the "permissionless innovation" model that gave rise to the internet by requiring business to prepare impact assessment before launching new features children might access. He expects the consequence of this will be businesses designing products to avoid the regulatory headaches of dealing with children – products that might have benefited children.

The law, he argues, disempowers parents by foisting the government's interpretation of appropriate barriers onto all. He argues the law shifts the fiduciary duty of companies to favor the interests of children over other considerations. And he expresses concern that the law will encourage the adoption of facial scans as a means of age determination, despite the well-known privacy problems with face scanning.

[17]FTC signals crackdown on ed-tech harvesting kid's data

[18]America edges closer to a federal data privacy law, not that anyone can agree on it

[19]Big Tech loves talking up privacy – while trying to kill privacy legislation

[20]Stupid law of the week: South Carolina wants anti-porno chips in PCs that cost $20 to disable

"The California Age-Appropriate Design Code Act changes the ground rules for technology companies yet again, adding a new layer of privacy legislation for companies whose online products or services are likely to be accessed by minors under the age of 18," said Christine Lyon, partner and global co-head of data privacy and security at law firm Freshfields, in an email to The Register .

Lyon said the law will affect companies not subject to COPPA, the federal data privacy law focused on children under 13.

"Although they have nearly two years before the Act goes into effect, technology companies will need this lead time to assess which of their products or services are likely to be accessed by users under 18 and to modify their covered products/services for those users, including by limiting collection and use of data about those users, configuring default privacy settings to a high level for them, and performing formal data protection impact assessments that must be provided to the California Attorney General upon request," she said.

"Ultimately, this law will dramatically reshape how technology companies approach online products and services that not targeted to children, but still may be likely to be accessed by minors under the age of 18." ®

Get our [21]Tech Resources



[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202120220AB2273

[2] https://ico.org.uk/for-organisations/guide-to-data-protection/ico-codes-of-practice/age-appropriate-design-code/

[3] https://www.theregister.com/2022/08/30/california_child_protection_law/

[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YyP04s39oenbQ5QKIjs86AAAAAU&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0

[5] https://www.gov.ca.gov/2022/09/15/governor-newsom-signs-first-in-nation-bill-protecting-childrens-online-data-and-privacy/

[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyP04s39oenbQ5QKIjs86AAAAAU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyP04s39oenbQ5QKIjs86AAAAAU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[8] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YyP04s39oenbQ5QKIjs86AAAAAU&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0

[9] https://www.fightforthefuture.org/news/2022-09-15-californias-kids-safety-and-transparency-bills-wont-make-kids-safer-or-platforms-more-transparent-but-they-will-undermine-human-rights-and-free-expression

[10] https://twitter.com/evan_greer/status/1570504271996792832

[11] https://thehill.com/homenews/state-watch/3642407-newsom-signs-controversial-social-media-bill-into-california-law/

[12] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_onprem/personaltech&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YyP04s39oenbQ5QKIjs86AAAAAU&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0

[13] https://blog.ericgoldman.org/archives/2022/09/some-memes-about-californias-age-appropriate-design-code-ab-2273.htm

[14] https://blog.ericgoldman.org/archives/2022/09/an-interview-regarding-ab-2273-the-california-age-appropriate-design-code-aadc.htm

[15] https://blog.ericgoldman.org/archives/2022/08/a-short-explainer-of-how-californias-age-appropriate-design-code-bill-ab2273-would-break-the-internet.htm

[16] https://blog.ericgoldman.org/archives/2022/09/five-ways-that-the-california-age-appropriate-design-code-aadc-ab-2273-is-radical-policy.htm

[17] https://www.theregister.com/2022/05/20/ftc_children_data/

[18] https://www.theregister.com/2022/06/15/federal_data_privacy/

[19] https://www.theregister.com/2022/05/27/big_tech_privacy/

[20] https://www.theregister.com/2016/12/19/south_carolina_calls_for_smutfree_pcs/

[21] https://whitepapers.theregister.com/