Constangy Cyber Advisor 

Last week, we blogged about new legislation in the United States and internationally that emphasizes child online safety in addition to privacy.

Noncompliance may expose organizations to a variety of regulatory and litigation risks, including the following:

• Privacy and data protection investigations and enforcement actions by the Federal Trade Commission, state attorneys general, and other regulators.
• Child safety and online safety investigations.
• Consumer protection and product liability claims.

Organizations should be prepared for increased litigation and enforcement activity concerning children’s online experiences. Depending on the jurisdiction and theory of liability, claims may focus on allegedly manipulative product design, engagement features, inadequate protections for children, misleading safety representations, or failures to implement legally required safeguards.

Recent matters illustrate the potential scale of this exposure:

• In August 2026, Meta reached a court-approved multistate settlement providing for more than $12 billion in payments, with additional payments contingent on specified conditions involving other major platforms. The settlement also requires changes to age assurance, time limits, and safety features for teens.
• In September 2026, TikTok reached a settlement with Alabama requiring a minimum of $100 million in payments and a package of teen-safety measures, including age-verification enhancements, time and nighttime-use restrictions, parental controls, content moderation, and changes to recommendation and account settings.
• California A.B. 2, signed into law on September 10, will provide for statutory damages where a covered social media platform’s failure to exercise ordinary care or skill causes injury to a child. The law, which will take effect on January 1, applies to platforms generating more than $100 million in annual gross revenue and authorizes the greater of $5,000 per violation (subject to a $1 million per-child cap) or three times actual damages.

In response, organizations should evaluate whether their existing compliance programs address not only children’s data, but also product design and child safety obligations. Depending on the service and jurisdiction, these are among the areas to monitor:

• Age-assurance and age-identification measures.
• Parental consent and parental-control requirements.
• AI functionality directed to or meaningfully used by children.
• AI companion, chatbot, and crisis-response safeguards.
• Age-appropriate privacy defaults, product design, and engagement controls.

Conducting an assessment in these areas before a feature launches gives businesses an opportunity to build the relevant safeguards into their designs.

Practical steps for compliance

For businesses, the practical implication is that children’s privacy, AI governance, product safety, and platform-design reviews can no longer operate in separate silos. A child-accessible product may trigger overlapping obligations based on the user’s age, the type of data collected, the product’s functionality, and the jurisdiction in which the user is located. Here are some precautions that businesses should take:

• Identify whether children are intended or likely users of the service, including their ages and locations.
• Inventory AI features, including companion chatbots, personalization tools, persistent memory, emotional-engagement capabilities, and safety controls.
• Assess product-design features such as algorithmic recommendation feeds, autoplay, infinite scroll, notifications, and other engagement mechanisms.
• Conduct documented risk assessments addressing privacy, child safety, foreseeable misuse, product-specific harms, and applicable statutory requirements.
• Integrate child-safety considerations into privacy reviews, AI governance, age-assurance programs, vendor management, advertising practices, and product-development processes.
• Assign responsibility for cross-functional reviews, and establish escalation procedures for child safety concerns.

Organizations should create a repeatable process for identifying these obligations early in product development and reevaluating them throughout the life cycle of the product or service.

Final thoughts

Recent developments reflect a broader approach to children’s digital safety that addresses both data protection, privacy, and product design. For businesses offering products and services used by children, privacy programs, AI governance, and child safety should be considered together throughout the life cycle of the product. Businesses should build appropriate safeguards into their products and services from the outset and reassess those protections as features, user populations, and legal requirements continue to evolve.

The Constangy Cyber Team assists businesses of all sizes and industries with compliance needs. If you would like additional information about state or federal data privacy laws, please contact us at cyber@constangy.com.