Wednesday, September 21, 2022
California Governor Gavin Newsom signed the California Age-Appropriate Design Code Act (the Act) into law last week. This new law will require those online service providers likely to be accessed by children under 18 years old to comply with heightened privacy requirements, including incorporating privacy-by-default and privacy-by-design into their products. The 18-year age threshold for defining a child online is several years higher than the federal standard set by the Children's Online Privacy Protection Act, which protects data collected from online users under 13. The bulk of the new bill requires online service providers to complete a Data Protection Impact Assessment for any online service, product, or feature likely to be accessed by children. The bill additionally prohibits businesses from using children's data for any purpose other than the reason for which it was originally collected and requires them to prioritize children's well-being over business considerations.