In the last few months, California and New Jersey enacted legislation to protect children online: California’s 13-bill package targets risks to children arising from emerging technologies, while New Jersey’s 3-bill package includes an age-appropriate design code. Despite their differences, these laws share a common focus on protecting children as technology evolves.
This post summarizes the key provisions of these new laws.
Companies offering online services, social media platforms, or AI-enabled tools directed to or likely to be accessed by children should monitor these developments closely as new obligations begin to take effect. For additional context, see our prior discussion of children’s data and social media privacy laws.
California
On September 10, 2026, California Governor Gavin Newsom signed 13 bills targeting online and AI-related risks to children. The new laws address AI companion chatbots, addictive social media features, targeted advertising, and student data.
The package’s most significant measures include:
- SB 1119 / Adam’s Law (core requirements operative on July 1, 2027): Imposes child safety requirements on operators of covered AI companion chatbots. Operators must determine users’ ages or apply the required protections to all users, conduct risk assessments, publish a child safety policy, implement a crisis response protocol, use protective design defaults, provide parental controls, and restrict certain interactions with, and functionality available to, users under 18. The law also restricts targeted advertising, sales and certain uses of child users’ personal information, and dark patterns in relevant interfaces.
- AB 1709 (effective January 1, 2027): Prohibits covered online platforms from providing users under the age of 16 with addictive features, including addictive feeds and autoplay. Covered platforms must use age signals to determine users’ ages and, if they cannot provide an account without addictive features, delete the child’s account and associated personal information.
- AB 2246 (effective January 1, 2027): Replaces California’s earlier Age-Appropriate Design Code with a new framework for online services, products, and features likely to be accessed by children under the age of 18. Covered entities must estimate users’ ages with reasonable certainty or apply child protections to all users, use high privacy default settings, provide child-friendly privacy information, limit collection, use, sharing, and retention of children’s personal information, restrict geolocation collection and use, and take reasonable steps to prevent specified risks of harm to children.
- AB 2 (effective January 1, 2027 until January 1, 2035): Temporarily makes social media platforms with annual revenue of at least $1 million liable for statutory damages when they fail to exercise ordinary care or skill and cause injury to a child.
- SB 867 (effective January 1, 2027 until January 1, 2031): Temporarily prohibits the manufacture and sale of toys that include a companion chatbot when manufacturers design, market, or manufacture those toys for use in play by children under age 16.
- AB 1159 (core requirements operative on July 1, 2027): Expands California’s K–12 and early-learning student data privacy laws to cover certain operators, and entities working on their behalf, that provide online services or applications used for school purposes, and prohibits covered operators from using covered student information to train or develop AI systems. The law also creates the Higher Education Student Information Protection Act, which establishes similar protections for higher-education students.
Overall, the package takes a broader approach to children’s online safety than traditional privacy laws by regulating the design and operation of services accessible to children, including engagement features, age-assurance processes, AI interactions, and safety controls.
New Jersey
On August 11, 2026, New Jersey governor Mikie Sherrill signed a 3-bill package addressing children’s online privacy, safety, and social media use. The package includes the New Jersey Kids Code Act, along with two measures establishing a research center and directing further study of addictive social media use. The following summarizes each law:
- A4015 / S3413 / New Jersey Kids Code Act (effective September 1, 2027): New Jersey became the sixth state to enact a standalone age-appropriate design code for online services accessible to children. This law requires covered online service providers to use high privacy default settings for children under the age of 18, provide specified user tools and controls, and implement measures to address design features that can contribute to compulsive use or other safety risks. It also restricts certain notifications, precise-geolocation practices, and interface designs that undermine children’s privacy choices.
- A4014 / S3411 (effective immediately): Establishes a Social Media Research Center to study the impacts of social media consumption and provide recommendations regarding addictive social media behaviors among children.
- S3412 / A4013 (effective immediately): Directs the Social Media Research Center to study whether warning labels and mandatory disclaimers could reduce addictive social media behaviors among children.
Looking Ahead
As states continue to legislate in this area, companies offering online services, social media platforms, or AI-enabled tools directed to or likely to be accessed by children should review their age-assurance practices, default privacy settings, use and sharing of children’s data, and youth-facing product features for potential safety and design risks.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
