A California child design law remains blocked in part by courts

The short answer

California's Age-Appropriate Design Code would have required online services likely to be used by children to switch on high-privacy settings by default, assess and limit risks from their own design choices, and estimate users' ages, among other things. A federal appeals court has since said the part requiring companies to judge and mitigate risk from harmful content probably violates the First Amendment, and sent the rest of the law back to a lower court to sort out. In practice, most of the law is not currently being enforced.

What the evidence says

The California Legislature passed, and the Governor signed, Assembly Bill 2273 on 15 September 2022, according to the bill text on file with the state legislature. As written, it required businesses whose services are likely to be accessed by children to configure default privacy settings to a high level of privacy absent a compelling reason otherwise, complete data protection impact assessments addressing algorithmic and advertising harms before launching features accessible to children, estimate child users' ages with reasonable accuracy, and avoid dark patterns aimed at extracting more of children's data, effective 1 July 2024. NetChoice, a trade association, sued, moving for a preliminary injunction on 17 February 2023; a federal district court granted it on 18 September 2023, before that effective date arrived. On 16 August 2024, the Ninth Circuit decided the resulting appeal. Its opinion held that NetChoice was likely to succeed in showing the requirement to opine on and mitigate the risk that children might see harmful content facially violates the First Amendment, and affirmed the injunction against that provision and anything not severable from it. The panel vacated the rest of the injunction, saying it was unclear whether the law's other provisions, including default settings and age estimation, independently violate the First Amendment, and remanded for further proceedings.

For context

This is not a final ruling that the whole law is unconstitutional, nor one that clears it to take effect; it is a preliminary-injunction decision that leaves most of the statute's fate to further litigation. The provision the court found most clearly problematic was the duty to affirmatively assess and mitigate harm from content, treated differently from more mechanical requirements like default privacy settings. Other jurisdictions have taken related approaches, and this case is often cited in that wider debate, but it resolves only what California's design code requires and what one appeals court said about part of it.

A practical next step

Rather than assuming this law governs the services your family uses, it may be worth checking a platform's own stated default privacy settings for minors, since the code's central requirement is not being enforced as written.

• Does a service your child uses publish its own default privacy settings for minors, independent of any state law?
• Would you want to follow this case further before treating California's design code as settled law?
• Are there other state or platform-level protections that already apply regardless of this litigation?

The design code remains a live legal question, not an operating rule, and its final shape depends on proceedings still ahead in court.