SB 680: Features that harm child users: civil penalty.

The California Consumer Privacy Act of 2018 prohibits a business from selling the personal information of a consumer if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of a consumer at least 13 years of age and less than 16 years of age, or the consumers parent or guardian, in the case of a consumer who is less than 13 years of age, has affirmatively authorized the sale of the consumers personal information.

The California Age-Appropriate Design Code Act requires, beginning July 1, 2024, a business that provides an online service, product, or feature likely to be accessed by children to comply with specified requirements, including a requirement to configure all default privacy settings offered by the online service, product, or feature to the settings that offer a high level of privacy, as prescribed, and requires a business, before any new online services, products, or features are offered to the public, to complete a Data Protection Impact Assessment for any online service, product, or feature likely to be accessed by children and maintain documentation of this assessment as long as the online service, product, or feature is likely to be accessed by children.

This bill would prohibit a social media platform, as defined, from using a design, algorithm, or feature that the platform knows, or by the exercise of reasonable care should have known, causes child users, as defined, to do any of certain things, including experience addiction to the social media platform.

This bill would provide that a social media platform is not in violation of the bill if the social media platform instituted and maintained a program of at least quarterly audits, as defined, of its designs, algorithms, and features that have the potential to cause violations of the provision described above, and the social media platform corrected, within 30 60 days of the completion of the audit, any design, algorithm, or feature discovered by the audit to present more than a de minimis risk of violating that provision.

This bill would subject a social media platform that knowingly and willfully violates these provisions to a civil penalty not to exceed $250,000 per violation, an injunction, and an award of litigation costs and attorneys fees in an action brought only by certain public attorneys, including the Attorney General.