Expanding California Child Privacy Act Continues to Face Opposition

Jacob Goldberg, writing on the Stoel Rives Global Privacy and Security site, discusses recent developments surrounding California’s Age Appropriate Design Code Act (CAADCA), hailed by supporters as the first effort to establish a secure online environment for children.

The CAADCA expands upon the existing federal law, the Children’s Online Privacy Protection Act, by broadening the scope of protection to include individuals aged 13 to 18. Additionally, it introduces a new category of regulated entities: businesses likely to be accessed by children. However, the Act is facing opposition on First Amendment grounds.

In December 2022, an online business trade association filed a lawsuit in California seeking to halt the enactment of the CAADCA. The allegations included claims of unconstitutional regulation of speech and violating the First Amendment.

In September 2023, the court issued an injunction, recognizing the state’s significant interest in safeguarding the well-being of minors. However, it found that certain provisions of the Act were not sufficiently tailored to this interest. As these provisions were inseparable from the law itself, the court prevented the CAADCA from taking effect.

The legal dispute is ongoing, with California appealing the district court’s decision to the Ninth Circuit. It is possible that some or all of the CAADCA may be reinstated. Meanwhile, in California’s current legislative session, two bills have been introduced to expand child privacy regulations.

Similar measures to the CAADCA have been introduced in legislatures of seven other states, while Congress is also deliberating on its own legislation concerning online children’s privacy, known as the Kids Online Safety Act.

The author advises businesses offering online products or features likely to be accessed by children under 18 to monitor pending legislation and legal proceedings and to consider implementing a children’s online privacy compliance program as part of their overall compliance strategy.