At a Glance<\/h2>\n \n \n \n \n Key Takeaways<\/button>\n <\/span>\n \n \n \n\n\n- The CAADC (AB 2273) was signed into law in September 2022 and was set to take effect July 1, 2024. Court injunctions have continuously blocked enforcement since September 2023.<\/li>\n\n\n\n
- The Ninth Circuit's March 2026 ruling upheld injunctions against five of six challenged provisions. One \u2014 a restriction on collecting and sharing minors' geolocation data \u2014 was allowed to stand.<\/li>\n\n\n\n
- The law applies to any business that meets the CCPA's definition of a \"business\" and offers an online service \"likely to be accessed by children\", not just platforms that target minors.<\/li>\n\n\n\n
- Core requirements include privacy-by-default settings, data minimization, restrictions on profiling minors, a prohibition on dark patterns, and pre-launch Data Protection Impact Assessments (DPIAs).<\/li>\n\n\n\n
- Civil penalties reach USD 2,500 per affected child per negligent violation and USD 7,500 per affected child per intentional violation, with no cap per incident.<\/li>\n\n\n\n
- Even with the CAADC blocked, COPPA and CCPA\/CPRA obligations governing children's data are actively enforced. The April 22, 2026, deadline for COPPA rule compliance is the most immediate pressure point.<\/li>\n<\/ul>\n\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n\n
California's Age-Appropriate Design Code Act is one of the most ambitious children's data privacy laws ever passed in the U.S. Signed in 2022 and modeled on the UK's Children's Code, it sets design-level requirements \u2014 not just consent checkboxes \u2014 for any online service that minors are likely to use.<\/p>\n\n\n\n
Courts have blocked enforcement since before its July 2024 effective date, and the Ninth Circuit's March 2026 ruling<\/a> upheld most of those injunctions. But for U.S. businesses, the CAADC is not an abstract risk. The compliance obligations it mirrors are already embedded in federal law and active California enforcement \u2014 and the states are moving fast.<\/p>\n\n\n\nThis guide explains what the CAADC requires, where litigation stands, what obligations apply right now, and how to build a defensible data practices posture before the legal landscape settles.<\/p>\n\n\n\n
CAADC: What Is the California Age-Appropriate Design Code Act?<\/h2>\n\n\n\n
The California Age-Appropriate Design Code Act (AB 2273<\/a>) was signed into law in September 2022. Modeled on the UK's Age Appropriate Design Code<\/a>, which itself was issued under the UK GDPR's Article 25<\/a> data protection by design framework, it was intended as the first GDPR-influenced children's privacy statute in U.S. state law.<\/p>\n\n\n\n
- \n
- The CAADC (AB 2273) was signed into law in September 2022 and was set to take effect July 1, 2024. Court injunctions have continuously blocked enforcement since September 2023.<\/li>\n\n\n\n
- The Ninth Circuit's March 2026 ruling upheld injunctions against five of six challenged provisions. One \u2014 a restriction on collecting and sharing minors' geolocation data \u2014 was allowed to stand.<\/li>\n\n\n\n
- The law applies to any business that meets the CCPA's definition of a \"business\" and offers an online service \"likely to be accessed by children\", not just platforms that target minors.<\/li>\n\n\n\n
- Core requirements include privacy-by-default settings, data minimization, restrictions on profiling minors, a prohibition on dark patterns, and pre-launch Data Protection Impact Assessments (DPIAs).<\/li>\n\n\n\n
- Civil penalties reach USD 2,500 per affected child per negligent violation and USD 7,500 per affected child per intentional violation, with no cap per incident.<\/li>\n\n\n\n
- Even with the CAADC blocked, COPPA and CCPA\/CPRA obligations governing children's data are actively enforced. The April 22, 2026, deadline for COPPA rule compliance is the most immediate pressure point.<\/li>\n<\/ul>\n\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n <\/div>\n<\/div>\n\n\n\n
California's Age-Appropriate Design Code Act is one of the most ambitious children's data privacy laws ever passed in the U.S. Signed in 2022 and modeled on the UK's Children's Code, it sets design-level requirements \u2014 not just consent checkboxes \u2014 for any online service that minors are likely to use.<\/p>\n\n\n\n
Courts have blocked enforcement since before its July 2024 effective date, and the Ninth Circuit's March 2026 ruling<\/a> upheld most of those injunctions. But for U.S. businesses, the CAADC is not an abstract risk. The compliance obligations it mirrors are already embedded in federal law and active California enforcement \u2014 and the states are moving fast.<\/p>\n\n\n\n
This guide explains what the CAADC requires, where litigation stands, what obligations apply right now, and how to build a defensible data practices posture before the legal landscape settles.<\/p>\n\n\n\n
CAADC: What Is the California Age-Appropriate Design Code Act?<\/h2>\n\n\n\n
The California Age-Appropriate Design Code Act (AB 2273<\/a>) was signed into law in September 2022. Modeled on the UK's Age Appropriate Design Code<\/a>, which itself was issued under the UK GDPR's Article 25<\/a> data protection by design framework, it was intended as the first GDPR-influenced children's privacy statute in U.S. state law.<\/p>\n\n\n\n
![\"\"](\"https:\/\/www.cookiebot.com\/us\/wp-content\/uploads\/sites\/8\/2026\/05\/childrens-personal-data.svg?v=d66741e4ece14c66\"\n)
\n <\/figure>\n <\/div>\n