Vote Smart's Synopsis:

Vote to amend and pass a bill that establishes new data privacy protections for children.

Highlights:

• Establishes the California Age Appropriate Design Code Act (Sec. 2, Pg. 3).

• Prohibits companies from leading or encouraging children to provide personal information beyond what is reasonably expected (Sec. 2, Pg. 5).

• Prohibits companies from using a child’s personal information in a way that can be expected to harm the child’s physical or mental health (Sec. 2, Pg. 4).

• Prohibits companies from collecting, selling, sharing, or retaining personal information that is not necessary to provide an online service, product, or feature to a child (Sec. 2, Pg. 4).

• Specifies that the above also applies to geolocation information, and prohibits companies from collecting precise geolocation information of a child without providing a sign to the child that the company is doing so (Sec. 2, Pgs. 4 & 5).

• Prohibits any company from using a child’s personal information for any reason other than the original reason for collecting the information (Sec. 2, Pg. 4).

• Requires companies to establish and routinely report on a Data Protection Impact Assessment for each online product, service, or feature likely to be accessed by a child in order to assess and mitigate risks to children (Sec. 2, Pgs. 3 & 4).

• Defines products that are likely to be accessed by children to mean an online product, service, or feature that can be reasonably expected to be accessed by children due to direct or indirect marketing, market research, or because the product is similar to or has aspects of products that usually attract children (Sec. 2, Pg. 3).

• Requires companies to either establish a certain age that is appropriate to be exposed to the risks of the company’s data management policies, or apply to all consumers the same data protections afforded to children (Sec. 2, Pg. 4).

• Requires companies to make their default privacy settings for all online products likely to be accessed by children set to the highest possible privacy protection offered by the business (Sec. 2, Pg. 4).

• Requires companies to ensure that all terms of service and policy agreements for related products are concise and understandable by children (Sec. 2, Pg. 4).

• Requires companies to provide an obvious signal to children when their activity is being monitored or tracked when using an online product that allows the child’s parent or guardian to monitor their activity (Sec. 2, Pg. 4).

• Requires companies to enforce all privacy policies and provide the means for children and parents to exercise their privacy rights and report concerns (Sec. 2, Pg. 4).

• Prohibits a company from profiling a child using their online product or service (Sec. 2, Pg. 4).

• Prohibits companies from using personal information to establish a user’s age or age range for any purposes (Sec. 2, Pg. 5).

• Requires the California Privacy Protection Agency to establish the California Children’s Data Protection Taskforce (Sec. 2, Pg. 5).

• Specifies that companies violating the above provisions are subject to an injunction and a civil penalty of no more than $2,500 per affected child for each negligent violation, and $7,500 per child for intentional violations (Sec. 2, Pg. 5).

• Specifies that this act furthers the intent of the California Privacy Rights Act of 2020 (Sec. 3, Pg. 6).

Full Bill Text