Constangy Cyber Advisor 

Historically, children’s privacy laws have focused primarily on the collection, use, and disclosure of minors’ personal information. However, lawmakers and regulators are now examining the way digital products and platforms are designed and their effects on children. This new emphasis applies to algorithmic recommendation feeds, artificial intelligence chatbot interactions, autoplay, persistent notifications, and other engagement-driven features.

U.S. and international policymakers have continued to focus on social media use, AI companions, age assurance, and other online risks involving children. However, businesses should expect privacy, AI governance, product design, and consumer-protection obligations to become increasingly interconnected, and a single feature may raise issues across all of these areas at once.

Beyond privacy

Regulators are continuing to focus on the information that businesses collect from children. However, they are also beginning to consider the ways that products and platforms may influence children’s behavior, choices, and online experience.

This shift from a predominantly privacy-based emphasis toward broader digital-safety regulation is particularly significant for businesses offering AI-enabled services, personalized feeds, social features, or other engagement-driven products that are directed to or frequently accessed by children.

This broader focus is reflected in the range of issues drawing regulatory attention across jurisdictions, including the following:

• AI companions and simulated relationships
• Potentially compulsive or excessive social media use
• Algorithmic recommendation systems and personalized feeds
• Autoplay, infinite scroll, notifications, and other engagement features
• Collection, use, and monetization of children’s personal and sensitive information
• Potential mental health, developmental, and safety risks

Recent laws and proposals show how these concerns are transforming into new obligations and proposed safeguards for products and services used by children.

California leads the way

In September 2026, Gov. Gavin Newsom (D) signed into law several measures that expand online protections for children and regulate features associated with AI companions and engagement-driven platforms. Together, these laws impose new requirements concerning companion chatbots, age assurance, addictive features, privacy defaults, product design, and civil liability.

Adam’s Law (S.B. 1119) expands existing protections for users of companion chatbots. The existing companion-chatbot law, S.B. 243, already requires AI disclosures, suicide and self-harm protocols, and additional protections for users who are known to be minors. Beginning July 1, 2027, covered operators must either determine users’ ages through specified age-assurance mechanisms or extend specified child protections to all users. For operators allowing users who are minors, the law requires risk assessments, a public child-safety policy, crisis-response protocols, parental controls, usage limits, age-appropriate disclosures, and safeguards addressing specified harmful interactions. It also requires independent child-safety audits generally beginning in 2029. The legislation also restricts advertising and certain uses of children’s personal information while providing public enforcement mechanisms and a private right of action.

Effective January 1, 2027, A.B. 1709 will prohibit covered platforms from providing specified “addictive features,” including addictive feeds and autoplay, to users under age 16. Covered platforms must comply with California’s age-assurance requirements before providing those features. The law will require platforms with “addictive features” to delete accounts and associated personal information for anyone who is under age 16. (An under-16 user can be retained if the account does not provide an “addictive feature.”) Violations can result in civil penalties of up to $50,000 per affected minor for knowing violations, and up to $25,000 per affected minor for negligent violations.

Finally, beginning January 1, A.B. 2246 will repeal and replace California’s prior Age-Appropriate Design Code with new requirements for online services, products, and features likely to be accessed by children. Among other requirements, the law will mandate high-privacy default settings, age-appropriate disclosures, limits on profiling and unnecessary collection and use of children’s personal information, restrictions on precise geolocation, limits on dark patterns, and reasonable steps to prevent specified risks of harm to children.

Taken together, these measures illustrate California’s increasing focus on both data practices and the design, functionality, and safety controls of digital and online products and services used by children.

COPPA and federal developments

The Children’s Online Privacy Protection Act was originally enacted in 1998 to give parents greater control over the online collection of personal information from children under 13. In 2025, the Federal Trade Commission amended its COPPA regulations to strengthen those protections. Among other changes, the amended regulations expand the definition of personal information to include biometric and government-issued identifiers, require separate verifiable parental consent for disclosures to third parties, including for targeted advertising (subject to certain exceptions), and strengthen data retention and security requirements.  This past February, the FTC said that it would not bring COPPA enforcement actions against certain operators, subject to specified conditions, for collecting, using, or disclosing personal information solely to determine a user’s age without first obtaining parental consent.

The Kids Internet and Digital Safety Act, known as the “KIDS Act,” remains pending. The House of Representatives passed the bill on June 29, and it was referred to the Senate Committee on Commerce, Science, and Transportation on July 13. The package combines multiple child-safety and privacy proposals, including versions of the Kids Online Safety Act and COPPA 2.0, along with other measures addressing online services used by children. If enacted, it would create new requirements for product design, privacy, parental tools, and audits.

International developments

Proposed EU KIDS Act

On September 17, the European Commission published its proposal for the EU KIDS Act. The proposed regulation would establish age rules for certain social networking and video-sharing services with features that pose risks to children. On those services, children under age 13 generally would not be able to have an account, children ages 13 and 14 could use limited accounts under parental supervision, and children 15 and older could open accounts independently. Covered services would need to use certified, privacy-preserving age verification rather than relying solely on self-reported dates of birth.

The proposal also addresses the manner in which services used by children are designed. It would restrict features that encourage compulsive use, require safer settings and recommender systems, and provide parental controls. The legislation would also address designs in AI chatbots and companions that are accessible to minors and that may foster emotional dependency. These include testing, monitoring for harm after launch, and requiring restrictions by default against resuming earlier online conversations.

UK, China, Australia

In the United Kingdom, certain covered user-to-user and search services that are likely to be accessed by children must assess the risks of harmful content and implement protections under the Online Safety Act. The European Commission’s July 2025 guidelines under the Digital Services Act address age assurance, recommender systems, addictive design, and other risks to minors.

China’s rules for AI services that provide ongoing emotional interactions simulating human characteristics took effect this past July. The rules prohibit virtual intimate-relationship services for minors, including simulated family or partner relationships, and require the consent of a parent or guardian for other covered services provided to children under age 14.

A separate draft proposed last month would expand child-safety measures across online services, smart devices, and app stores.

Since December 2025, Australia has required age-restricted social media platforms to take reasonable steps to prevent children under 16 from creating or having accounts.

In Part Two, we’ll discuss what businesses need to do in light of the increased emphasis on child safety.

The Constangy Cyber Team assists businesses of all sizes and industries with compliance needs. If you would like additional information about state or federal data privacy laws, please contact us at cyber@constangy.com.