Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections.

This bill, beginning January 1, 2027, would require, among other things related to age verification with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the users age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

This bill would prohibit an operating system provider or a covered application store from using data collected from a third party in an anticompetitive manner, as specified.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

This bill would declare its provisions to be severable.

Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections.

This bill, beginning January 1, 2027, would require, among other things related to age verification with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the users age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would require a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

This bill would prohibit an operating system provider or a covered application store from using data collected from a third party in an anticompetitive manner, as specified.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

This bill would declare its provisions to be severable.

Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections.

This bill bill, beginning January 1, 2027, would require, among other things related to age verification on the internet, a covered manufacturer with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the users age bracket to applications available in a covered application store and to provide a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would define covered manufacturer to mean a person who is a manufacturer of a device, an operating system for a device, or a covered application store. The bill would require a developer to request a signal with respect to a particular user from a covered manufacturer an operating system provider or a covered application store when that user requests to download an application. the application is downloaded and launched.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

This bill would declare its provisions to be severable.

Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections.

This bill would require, among other things related to age verification on the internet, a covered manufacturer to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the users age bracket to applications available in a covered application store and would require the covered manufacturer to provide developers, a developer, as defined, who has requested a signal with respect to a particular user with a digital signal via a real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would define covered manufacturer to mean a person who is a manufacturer of a device, an operating system for a device, or a covered application store. The bill would require a developer with actual knowledge of a users age to connect account holders with any existing tools to support a user with respect to the users use of the service and as appropriate given the risks that arise from use of the application. to request a signal with respect to a particular user from a covered manufacturer when that user requests to download an application.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

This bill would declare its provisions to be severable.

Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature or to forego privacy protections.

This bill would require, among other things related to age verification on the internet, a covered manufacturer to provide an accessible interface for requiring account holders, at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the users age bracket to applications available in a covered application store and would require the covered manufacturer to provide developers, as defined, with a digital signal via a real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would define covered manufacturer to mean a person who is a manufacturer of a device, an operating system for a device, or a covered application store. The bill would require a developer with actual knowledge of a users age to provide any readily available features for account holders connect account holders with any existing tools to support a user with respect to the users use of the service and as appropriate given the risks that arise from use of the application, as specified. application.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

Existing law generally provides protections for minors on the internet, including the California Age-Appropriate Design Code Act that, among other things, requires a business that provides an online service, product, or feature likely to be accessed by children to do certain things, including estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers and prohibits an online service, product, or feature from, among other things, using dark patterns to lead or encourage children to provide personal information beyond what is reasonably expected to provide that online service, product, or feature to forego privacy protections.

This bill would require, among other things related to age verification on the internet, a covered manufacturer to provide an accessible interface for requiring device owners account holders, as defined, to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the users age bracket to applications available in a covered application store and would require the covered manufacturer to provide developers developers, as defined, with a digital signal via a real-time application programming interface regarding whether a user is in any of several age brackets, as prescribed. The bill would define covered manufacturer to mean a person who is a manufacturer of a device, an operating system for a device, or a covered application store. The bill would require a developer, as defined, developer with actual knowledge that a user is a child via receipt of a signal regarding of a users age to, to the extent technically feasible, to provide any readily available features for parents account holders to support a child user with respect to the child users use of the service and as appropriate given the risks that arise from use of the application, as specified.

This bill would punish noncompliance with a civil penalty to be enforced by the Attorney General, as prescribed.

Existing law, the Information Practices Act of 1977, declares that the right to privacy is a personal and fundamental right protected by the California Constitution and by the United States Constitution and that all individuals have a right of privacy in information pertaining to them.

Existing law also declares that the increasing use of computers and other sophisticated information technology has greatly magnified the potential risk to individual privacy that can occur from the maintenance of personal information.

This bill would make a nonsubstantive change to those provisions.

CONCURRENCE IN SENATE AMENDMENTS

CSA1 Bill Id:AB 1043

Author:(Wicks)

As Amended Ver:September 5, 2025

Majority vote

SUMMARY

Establishes the Digital Age Assurance Act, which creates a signaling infrastructure that allows developers to rely on a real-time, secure indicator of a user's age bracket for purposes of complying with other California laws that require age verification.

Senate Amendments

1. Significantly narrow the bill by removing the provisions related to parental controls and limiting the bill to operating system providers and application developers.
2. Modify the age brackets to match those in the California Consumer Privacy Act:
   1. Under 13 years of age.
   2. At least 13 years of age but under 16 years of age.
   3. At least 16 years of age but under 18 years of age.
   4. At least 18 years of age.
3. Require developers to request the signal and the operating system providers to provide a signal when an app is downloaded and launched.
4. Require that that developers that receive the signal comply with applicable law.
5. Require operating systems to provide the ability for users to set up age bracket data in devices that have been set up before the January 1, 2027 implementation date and require the operating system to allow for account holders to indicate birth date, age or both before July 1, 2027
6. Require developers to request a signal for apps that have been downloaded before January 1, 2027 to request a signal before July 1, 2027.
7. Require that developers use internal clear and convincing information if developers have that information available and the signal is different from that information.
8. Prohibit developers from willfully disregarding internal clear and convincing information.
9. Exempts from liability an operating system provider, a covered application store, or a developer when a person who is not the user to whom a signal pertains uses a device or application.
10. Delay implementation date of January 1, 2027.

COMMENTS

Children today spend more time online than any generation before them—but the internet was not built with them in mind. While minors increasingly rely on digital platforms for education, entertainment, and socialization, they are routinely exposed to harms including exploitative content, manipulative design features, and addictive engagement mechanisms.

Although federal action is ultimately needed to standardize protections across jurisdictions, California's status as a tech capital and economic giant allows it to lead by example, often setting de facto national standards. The Digital Age Assurance Act (AB 1043) is the latest in a long lineage of California's efforts to protect its children from online harms. The bill attempts to do this by offering an infrastructure-level solution that avoids direct content regulation while enabling other child protection laws to function effectively.

California has enacted or proposed several laws to better protect minors in digital spaces, but enforcement and implementation remain stymied by a basic infrastructure gap: there is no standardized, privacy-preserving method for determining whether a user is a child. AB 1043, the Digital Age Assurance Act, seeks to fill that gap by establishing a secure signaling framework at the device and app store level. This framework allows developers to receive a tamper-resistant digital signal reflecting a user's age bracket—without requiring the collection of personal data or documents—and to treat that signal as the authoritative indicator of a user's age for compliance purposes under California law.

Striking a balance between parental control and children's privacy. In protecting children from the potential harms on the internet, like those discussed previously, there must be a careful balance between appropriate parental control and the rights of older teens to access certain platforms. At the core of this bill is a conceptually elegant solution for establishing the age of the user. By sending an age assurance signal that developers are required to rely on for having actual knowledge of the age of the user, provides a number of significant benefits:

1. It alleviates concerns from privacy advocates that age verification would necessarily require everyone to provide developers and platforms with even greater sensitive personal information by having to upload official identification documents in order to prove that they are old enough to access the application or the content.
2. It potentially removes the argument from the technology industry that have no definitive way of knowing the age of their users, thus allowing them to avoid responsibility for allowing children to access harmful content. As an example, applications that are restricted to adults generally simply ask the user to attest to whether or not they are old enough to access the site. With an age assurance signal, the platforms would be provided with actual knowledge of the age or age range of the user that they could then rely on to grant or deny access.
3. The State's consumer privacy law, the California Consumer Privacy Act, restricts the ability of businesses to be able to use, share, or sell personal information on minors. For those under 13, parental consent is required for the sharing or sale of a child's information, for those older children who are at least 13, but under 16, they must consent to having their personal information shared and sold. However, those restrictions only apply if a business has actual knowledge of the person's age. An age assurance signal sent to online businesses could provide that actual knowledge.

According to the Author

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely, and it is needed step for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

Arguments in Support

Children Now, the sponsor of this bill, writes:

The mental health of youth is in crisis. The challenges that families have faced for generations are exacerbated and amplified by modern technology. Parents, schools and governments are all grappling with the challenges of how to keep kids safe online. Simultaneously, connectivity provides opportunity for access to friends, family, community, and resources.

By sharing approximate users' age to developers of online products and services, AB 1043 will ensure that online platforms provide age-appropriate online experiences. AB 1043 marks an important step toward creating a developmentally safe online world that supports youths' mental, emotional, and social development.

Arguments in Opposition

Writing in opposition to the May 23rd version of the bill, Chamber of Progress argues:

Through its rigid, prescriptive requirements on device manufacturers and app stores, AB 1043 risks chilling innovation. Covered manufacturers would be forced to redirect their resources toward meeting strict and ineffective compliance mandates rather than continuing to focus on developing the tools to improve child safety online, delaying or preventing the rollout of new safety features. Innovators seeking to build new services tailored appropriately for youth, including educational platforms, mental health resources, and safe social spaces, would face higher barriers that, ironically, make it harder for companies to deploy the very protections the bill seeks to promote in a timely manner.

FISCAL COMMENTS

According to the Assembly Appropriations Committee:

1. Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate cases filed under the new cause of action created by this bill. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.

VOTES:

ASM PRIVACY AND CONSUMER PROTECTION: 13-0-2

YES: Bauer-Kahan, Dixon, Bryan, Irwin, Lowenthal, Macedo, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ABS, ABST OR NV: DeMaio, Patterson

ASM JUDICIARY: 12-0-0

YES: Kalra, Dixon, Bauer-Kahan, Bryan, Connolly, Harabedian, Macedo, Pacheco, Papan, Sanchez, Stefani, Zbur

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

ASSEMBLY FLOOR: 76-0-3

YES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Connolly, Davies, DeMaio, Dixon, Elhawary, Ellis, Flora, Fong, Gabriel, Gallagher, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, Macedo, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Sanchez, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

ABS, ABST OR NV: Lackey, Patterson, Ta

UPDATED

VERSION: September 5, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0002118

 THIRD READING  

Bill No: AB 1043

Author: Wicks (D), et al.

Amended: 9/5/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 12-0, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/29/25

AYES: Caballero, Seyarto, Cabaldon, Dahle, Grayson, Richardson, Wahab

ASSEMBLY FLOOR: 76-0, 6/2/25 - See last page for vote

SUBJECT: Age verification signals: software applications and online services

SOURCE: Children Now

DIGEST:

This bill imposes obligations on covered manufacturers to communicate certain information to developers, including age bracket information. This bill requires developers to request and treat age signals as the primary indicator of the user’s age.

Senate Floor amendments of 9/5/25 delay the operative date and narrow the scope of the bill, by, in part, including a number of exemptions, reducing the required age brackets, and replacing “covered manufacturer” with solely “operating system provider” for requirements imposed by the bill.

ANALYSIS:

Existing law:

1. Provides a right to free speech and expression. (U.S. Constitution (Const.), 1st amend; California (Cal.) Const., art 1, § 2.)
2. Recognizes certain judicially created exceptions to the rights of freedom of speech and expression. (E.g., Virginia v. Black (2003) 538 U.S. 343, 359.)
3. Requires, pursuant to the Parent’s Accountability and Child Protection Act, a person or business that conducts business in California, and that seeks to sell any product or service in or into California that is illegal under state law to sell to a minor to, notwithstanding any general term or condition, take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser. (Civil (Civ.) Code § 1798.99.1(a)(1).)
4. Establishes the California Consumer Privacy Act, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
5. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b).)
6. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
7. Establishes the Protecting Our Kids from Social Media Addiction Act, which prohibits an operator of an addictive internet-based service or application from providing an addictive feed to a user unless they have actual knowledge that the user is not a minor or the operator has obtained parental consent. (Health & Saf. Code § 27000 et seq.)

This bill:

1. Requires an operating system provider to provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
2. Requires an operating system provider to provide developers who have requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface (API) that identifies, at a minimum, which of several age brackets pertain to the user.
3. Requires an operating system provider to send only the minimum amount of information necessary to comply herewith and prohibits the sharing of the digital signal information with a third party for a purpose not required hereby.
4. Requires a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. Once the signal is received, the developer is deemed to have actual knowledge of the age rand of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal. A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.
5. Provides that the signal shall be treated as the primary indicator of a user’s age range. However, if a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant hereto, the developer shall use that information as the primary indicator of the user’s age.
6. Requires a developer that receives a signal indicating a user’s age range to use that signal to comply with applicable law but the developer shall not do either of the following:
   1. Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply herewith.
   2. Share the signal with a third party for a purpose not required by this title.
7. Subjects a person in violation to an injunction and to liability for a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. Such penalties are recoverable only in a civil action brought in the name of the people of the State of California by the Attorney General.
8. Provides that an operating system provider or a covered application store that makes a good faith effort to comply herewith, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal or any conduct by a developer that receives a signal.
9. Requires an operating system provider or covered application store to comply herewith in a nondiscriminatory manner, as provided.
10. Provides that with respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store. If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and the developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store with respect to that user before July 1, 2027.
11. Clarifies its scope and interaction with other laws. Provides that it becomes operative on January 1, 2027.
12. Includes a severability clause.
13. Defines the relevant terms.

Background

Children face numerous serious risks in online environments that can have lasting impacts on their development and wellbeing. Exposure to inappropriate content, including violent, sexual, or disturbing material, can be traumatic and age-inappropriate for developing minds. Cyberbullying and online harassment can lead to anxiety, depression, and social isolation, while predators may attempt to groom or exploit children through social media, gaming platforms, and messaging apps. Additionally, excessive screen time and addictive app design can interfere with sleep, physical activity, and real-world social development. Children may also inadvertently share personal information or fall victim to scams. Many approaches to solving these problems by requiring age verification have serious trade offs, whether it be privacy, security, or effectiveness.

This bill seeks to accomplish these goals by requiring operating system providers and app stores to obtain age information on minor users and to communicate this to app developers. Developers are required to request the signal then to treat these signals as the primary indicator of a user’s age, as provided. This bill is sponsored by Children Now. It is supported by several advocacy groups, including CFT — A Union of Educators & Classified Professionals, and Pinterest. It is opposed by Chamber of Progress.

Comments

According to the author:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. Expanding civil penalties could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.

SUPPORT: (Verified 9/10/25)

Children Now (source)

AAPI Equity Alliance

California Academy of Child and Adolescent Psychiatry

California Catholic Conference

California Civil Liberties Advocacy

California Parents for Public Virtual Education

CFT- a Union of Educators & Classified Professionals, AFT, AFL-CIO

Common Sense Media

#HalfTheStory

Internet Works

Latino Equality Alliance

Lenovo, Inc.

Parent Support for Online Learning

Pinterest, Inc.

The Source LGBT+ Center

OPPOSITION: (Verified 9/10/25)

Chamber of Progress

Technet

ARGUMENTS IN SUPPORT: Children Now, the sponsor of this bill, writes:

The mental health of youth is in crisis. The challenges that families have faced for generations are exacerbated and amplified by modern technology. Parents, schools and governments are all grappling with the challenges of how to keep kids safe online. Simultaneously, connectivity provides opportunity for access to friends, family, community, and resources.

By sharing approximate users’ age to developers of online products and services, AB 1043 will ensure that online platforms provide age-appropriate online experiences. AB 1043 marks an important step toward creating a developmentally safe online world that supports youths’ mental, emotional, and social development.

ARGUMENTS IN OPPOSITION: Chamber of Progress writes:

While it is important to encourage parental involvement to ensure minors’ safety online, parents are not always best suited to control how their child uses a platform. AB 1043 risks harming the very children it aims to protect, especially vulnerable youth. Many apps that provide critical services, such as platforms supporting mental, physical, and reproductive health, prioritize anonymity to ensure user safety and promote positive, help-seeking behaviors. Age-bracket signaling and automatic parental consent and control requirements, as outlined in AB 1043, could pressure app stores to collect more information, compromising privacy.

In situations where a parent does not support their child’s identity or seeks to restrict access to certain political, health, or other information, this authority can be utilized and weaponized as a tool of control, particularly in abusive or unhealthy home environments. For many youth, online spaces serve as a lifeline, offering access to communities, resources, and support networks that may not be available in their offline lives. LGBTQ+ youth, especially those who may live in communities hostile to their identity, see social media as a crucial tool to connect with LGBTQ+ groups, access content from people’s shared experiences, maintain positive connections, and reduce perceived isolation. LGBTQ+ youth use online platforms to seek emotional support, search for information about their identities, and find communities that accept them when their own parents do not. In fact, only 38% of LBGTQ youth report living in affirming households, while 60% reported finding online spaces to be supportive.

ASSEMBLY FLOOR: 76-0, 6/2/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Connolly, Davies, DeMaio, Dixon, Elhawary, Ellis, Flora, Fong, Gabriel, Gallagher, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, Macedo, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Sanchez, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO VOTE RECORDED: Lackey, Patterson, Ta

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/10/25 10:28:42

**** END ****

 THIRD READING  

Bill No: AB 1043

Author: Wicks (D), et al.

Amended: 9/5/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 12-0, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/29/25

AYES: Caballero, Seyarto, Cabaldon, Dahle, Grayson, Richardson, Wahab

ASSEMBLY FLOOR: 76-0, 6/2/25 - See last page for vote

SUBJECT: Age verification signals: software applications and online services

SOURCE: Children Now

DIGEST:

This bill imposes obligations on covered manufacturers to communicate certain information to developers, including age bracket information. This bill requires developers to request and treat age signals as the primary indicator of the user’s age.

Senate Floor amendments of 9/5/25 delay the operative date and narrow the scope of the bill, by, in part, including a number of exemptions, reducing the required age brackets, and replacing “covered manufacturer” with solely “operating system provider” for requirements imposed by the bill.

ANALYSIS:

Existing law:

1. Provides a right to free speech and expression. (U.S. Constitution (Const.), 1st amend; California (Cal.) Const., art 1, § 2.)
2. Recognizes certain judicially created exceptions to the rights of freedom of speech and expression. (E.g., Virginia v. Black (2003) 538 U.S. 343, 359.)
3. Requires, pursuant to the Parent’s Accountability and Child Protection Act, a person or business that conducts business in California, and that seeks to sell any product or service in or into California that is illegal under state law to sell to a minor to, notwithstanding any general term or condition, take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser. (Civil (Civ.) Code § 1798.99.1(a)(1).)
4. Establishes the California Consumer Privacy Act, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
5. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b).)
6. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
7. Establishes the Protecting Our Kids from Social Media Addiction Act, which prohibits an operator of an addictive internet-based service or application from providing an addictive feed to a user unless they have actual knowledge that the user is not a minor or the operator has obtained parental consent. (Health & Saf. Code § 27000 et seq.)

This bill:

1. Requires an operating system provider to provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
2. Requires an operating system provider to provide developers who have requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface (API) that identifies, at a minimum, which of several age brackets pertain to the user.
3. Requires an operating system provider to send only the minimum amount of information necessary to comply herewith and prohibits the sharing of the digital signal information with a third party for a purpose not required hereby.
4. Requires a developer to request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched. Once the signal is received, the developer is deemed to have actual knowledge of the age rand of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal. A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.
5. Provides that the signal shall be treated as the primary indicator of a user’s age range. However, if a developer has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant hereto, the developer shall use that information as the primary indicator of the user’s age.
6. Requires a developer that receives a signal indicating a user’s age range to use that signal to comply with applicable law but the developer shall not do either of the following:
   1. Request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply herewith.
   2. Share the signal with a third party for a purpose not required by this title.
7. Subjects a person in violation to an injunction and to liability for a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. Such penalties are recoverable only in a civil action brought in the name of the people of the State of California by the Attorney General.
8. Provides that an operating system provider or a covered application store that makes a good faith effort to comply herewith, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal or any conduct by a developer that receives a signal.
9. Requires an operating system provider or covered application store to comply herewith in a nondiscriminatory manner, as provided.
10. Provides that with respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store. If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and the developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store with respect to that user before July 1, 2027.
11. Clarifies its scope and interaction with other laws. Provides that it becomes operative on January 1, 2027.
12. Includes a severability clause.
13. Defines the relevant terms.

Background

Children face numerous serious risks in online environments that can have lasting impacts on their development and wellbeing. Exposure to inappropriate content, including violent, sexual, or disturbing material, can be traumatic and age-inappropriate for developing minds. Cyberbullying and online harassment can lead to anxiety, depression, and social isolation, while predators may attempt to groom or exploit children through social media, gaming platforms, and messaging apps. Additionally, excessive screen time and addictive app design can interfere with sleep, physical activity, and real-world social development. Children may also inadvertently share personal information or fall victim to scams. Many approaches to solving these problems by requiring age verification have serious trade offs, whether it be privacy, security, or effectiveness.

This bill seeks to accomplish these goals by requiring operating system providers and app stores to obtain age information on minor users and to communicate this to app developers. Developers are required to request the signal then to treat these signals as the primary indicator of a user’s age, as provided. This bill is sponsored by Children Now. It is supported by several advocacy groups, including CFT — A Union of Educators & Classified Professionals, and Pinterest. It is opposed by Chamber of Progress and Lenovo.

Comments

According to the author:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. Expanding civil penalties could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.

SUPPORT: (Verified 9/8/25)

Children Now (source)

AAPI Equity Alliance

California Academy of Child and Adolescent Psychiatry

California Catholic Conference

California Civil Liberties Advocacy

California Parents for Public Virtual Education

CFT- a Union of Educators & Classified Professionals, AFT, AFL-CIO

Common Sense Media

#HalfTheStory

Latino Equality Alliance

Parent Support for Online Learning

Pinterest, Inc.

The Source LGBT+ Center

OPPOSITION: (Verified 9/8/25)

Chamber of Progress

Lenovo, Inc.

Technet

ARGUMENTS IN SUPPORT: Children Now, the sponsor of this bill, writes:

The mental health of youth is in crisis. The challenges that families have faced for generations are exacerbated and amplified by modern technology. Parents, schools and governments are all grappling with the challenges of how to keep kids safe online. Simultaneously, connectivity provides opportunity for access to friends, family, community, and resources.

By sharing approximate users’ age to developers of online products and services, AB 1043 will ensure that online platforms provide age-appropriate online experiences. AB 1043 marks an important step toward creating a developmentally safe online world that supports youths’ mental, emotional, and social development.

ARGUMENTS IN OPPOSITION: Chamber of Progress writes:

While it is important to encourage parental involvement to ensure minors’ safety online, parents are not always best suited to control how their child uses a platform. AB 1043 risks harming the very children it aims to protect, especially vulnerable youth. Many apps that provide critical services, such as platforms supporting mental, physical, and reproductive health, prioritize anonymity to ensure user safety and promote positive, help-seeking behaviors. Age-bracket signaling and automatic parental consent and control requirements, as outlined in AB 1043, could pressure app stores to collect more information, compromising privacy.

In situations where a parent does not support their child’s identity or seeks to restrict access to certain political, health, or other information, this authority can be utilized and weaponized as a tool of control, particularly in abusive or unhealthy home environments. For many youth, online spaces serve as a lifeline, offering access to communities, resources, and support networks that may not be available in their offline lives. LGBTQ+ youth, especially those who may live in communities hostile to their identity, see social media as a crucial tool to connect with LGBTQ+ groups, access content from people’s shared experiences, maintain positive connections, and reduce perceived isolation. LGBTQ+ youth use online platforms to seek emotional support, search for information about their identities, and find communities that accept them when their own parents do not. In fact, only 38% of LBGTQ youth report living in affirming households, while 60% reported finding online spaces to be supportive.

ASSEMBLY FLOOR: 76-0, 6/2/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Connolly, Davies, DeMaio, Dixon, Elhawary, Ellis, Flora, Fong, Gabriel, Gallagher, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, Macedo, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Sanchez, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO VOTE RECORDED: Lackey, Patterson, Ta

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

9/8/25 21:33:26

**** END ****

 THIRD READING  

Bill No: AB 1043

Author: Wicks (D), et al.

Amended: 7/23/25 in Senate

Vote: 21

SENATE JUDICIARY COMMITTEE: 12-0, 7/15/25

AYES: Umberg, Allen, Arreguín, Ashby, Caballero, Durazo, Laird, Stern, Valladares, Wahab, Weber Pierson, Wiener

NO VOTE RECORDED: Niello

SENATE APPROPRIATIONS COMMITTEE: 7-0, 8/29/25

AYES: Caballero, Seyarto, Cabaldon, Dahle, Grayson, Richardson, Wahab

ASSEMBLY FLOOR: 76-0, 6/2/25 - See last page for vote

SUBJECT: Age verification signals: software applications and online services

SOURCE: Children Now

DIGEST:

This bill imposes obligations on covered manufacturers to communicate certain information to developers, including age bracket information. The bill requires developers to request and treat age signals as the primary indicator of the user’s age.

ANALYSIS:

Existing law:

1. Provides a right to free speech and expression. (U.S. Constitution (Const.), 1st amend; California (Cal.) Const., art 1, § 2.)
2. Recognizes certain judicially created exceptions to the rights of freedom of speech and expression. (E.g., Virginia v. Black (2003) 538 U.S. 343, 359.)
3. Requires, pursuant to the Parent’s Accountability and Child Protection Act, a person or business that conducts business in California, and that seeks to sell any product or service in or into California that is illegal under state law to sell to a minor to, notwithstanding any general term or condition, take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser. (Civil (Civ.) Code § 1798.99.1(a)(1).)
4. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
5. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b).)
6. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
7. Establishes the Protecting Our Kids from Social Media Addiction Act, which prohibits an operator of an addictive internet-based service or application from providing an addictive feed to a user unless they have actual knowledge that the user is not a minor or the operator has obtained parental consent. (Health & Saf. Code § 27000 et seq.)

This bill:

1. Requires a covered manufacturer to provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
2. Requires a covered manufacturer to provide developers who have requested a signal with respect to a particular user with a digital signal via a real-time application programming interface (API) identifying the age bracket of the user:
   1. Under five years of age.
   2. At least 5 years of age and under 10 years of age.
   3. At least 10 years of age and under 13 years of age.
   4. At least 13 years of age and under 16 years of age.
   5. At least 16 years of age and under 18 years of age.
   6. At least 18 years of age.
3. Requires a covered manufacturer to send only the minimum amount of information necessary to comply herewith and prohibits the sharing of the digital signal information with a third party for a purpose not required hereby.
4. Requires a developer to request a signal with respect to a particular user from a covered manufacturer when that user requests to download an application. Once the signal is received, the developer is deemed to have actual knowledge of the user’s age to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal. The signal shall be treated as the primary indicator of a user’s age.
5. Provides that a developer that relies in good faith on a signal indicating a user’s age provided by a covered manufacturer is presumed to have accurately determined the user’s age and to be in compliance with any state law that requires online age verification or parental guardian consent. This presumption is rebuttable by credible evidence that the user’s age is different than the signal.
6. Permits a developer that receives a signal indicating a user’s age to use that signal to comply with applicable law but shall not do either of the following:
   1. Request more information than the minimum amount of information necessary to comply with this title.
   2. Share the signal with a third party for a purpose not required by this title.
7. Subjects a person in violation to an injunction and to liability for a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. Such penalties are recoverable only in a civil action brought in the name of the people of the State of California by the Attorney General.
8. Provides that a covered manufacturer that makes a good faith effort to comply herewith, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal or any conduct by a developer that receives a signal.
9. Clarifies its scope and interaction with other laws.
10. Includes a severability clause.
11. Defines the relevant terms, including:
    1. “Account holder” means a parent or legal guardian of a user who is under 18 years of age.
    2. “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device. “Online service, product, or feature” does not include a broadband internet access or telecommunications service. This also excludes the delivery or use of a physical product.
    3. “Covered application store” means a publicly available website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or other general purpose computing device.
    4. “Covered manufacturer” means a person who is a manufacturer of a device, an operating system for a device, or a covered application store.
    5. “Developer” means a person that owns, maintains, or controls an application.
    6. “Signal” means age bracket data or notice of parent or guardian consent sent by a real-time secure API or operating system to an application.
    7. “User” means a child that is the primary user of the device.

Background

Children face numerous serious risks in online environments that can have lasting impacts on their development and wellbeing. Exposure to inappropriate content, including violent, sexual, or disturbing material, can be traumatic and age-inappropriate for developing minds. Cyberbullying and online harassment can lead to anxiety, depression, and social isolation, while predators may attempt to groom or exploit children through social media, gaming platforms, and messaging apps. Additionally, excessive screen time and addictive app design can interfere with sleep, physical activity, and real-world social development. Children may also inadvertently share personal information or fall victim to scams. Many approaches to solving these problems by requiring age verification have serious trade offs, whether it be privacy, security, or effectiveness.

This bill seeks to accomplish these goals by requiring manufacturers of devices, operating systems, and app stores to obtain age information on minor users and to communicate this to app developers. Developers are required to request the signal then to treat these signals as the primary indicator of a user’s age. This bill is sponsored by Children Now. It is supported by several advocacy groups, including CFT — A Union of Educators & Classified Professionals, and opposed by Chamber of Progress and Lenovo.

Comment

According to the author:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

FISCAL EFFECT: Appropriation: No Fiscal Com.: Yes Local: No

According to the Senate Appropriations Committee:

• Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. Expanding civil penalties could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.

SUPPORT: (Verified 8/29/25)

Children Now (source)

AAPI Equity Alliance

California Academy of Child and Adolescent Psychiatry

California Catholic Conference

California Civil Liberties Advocacy

California Parents for Public Virtual Education

CFT- a Union of Educators & Classified Professionals, AFT, AFL-CIO

#HalfTheStory

Latino Equality Alliance

Parent Support for Online Learning

The Source LGBT+ Center

OPPOSITION: (Verified 8/29/25)

Chamber of Progress

Lenovo, Inc.

Technet

ARGUMENTS IN SUPPORT: Children Now, the sponsor of the bill, writes:

The mental health of youth is in crisis. The challenges that families have faced for generations are exacerbated and amplified by modern technology. Parents, schools and governments are all grappling with the challenges of how to keep kids safe online. Simultaneously, connectivity provides opportunity for access to friends, family, community, and resources.

By sharing approximate users’ age to developers of online products and services, AB 1043 will ensure that online platforms provide age-appropriate online experiences. AB 1043 marks an important step toward creating a developmentally safe online world that supports youths’ mental, emotional, and social development.

ARGUMENTS IN OPPOSITION: Chamber of Progress writes:

While it is important to encourage parental involvement to ensure minors’ safety online, parents are not always best suited to control how their child uses a platform. AB 1043 risks harming the very children it aims to protect, especially vulnerable youth. Many apps that provide critical services, such as platforms supporting mental, physical, and reproductive health, prioritize anonymity to ensure user safety and promote positive, help-seeking behaviors. Age-bracket signaling and automatic parental consent and control requirements, as outlined in AB 1043, could pressure app stores to collect more information, compromising privacy.

In situations where a parent does not support their child’s identity or seeks to restrict access to certain political, health, or other information, this authority can be utilized and weaponized as a tool of control, particularly in abusive or unhealthy home environments. For many youth, online spaces serve as a lifeline, offering access to communities, resources, and support networks that may not be available in their offline lives. LGBTQ+ youth, especially those who may live in communities hostile to their identity, see social media as a crucial tool to connect with LGBTQ+ groups, access content from people’s shared experiences, maintain positive connections, and reduce perceived isolation. LGBTQ+ youth use online platforms to seek emotional support, search for information about their identities, and find communities that accept them when their own parents do not. In fact, only 38% of LBGTQ youth report living in affirming households, while 60% reported finding online spaces to be supportive.

ASSEMBLY FLOOR: 76-0, 6/2/25

AYES: Addis, Aguiar-Curry, Ahrens, Alanis, Alvarez, Arambula, Ávila Farías, Bains, Bauer-Kahan, Bennett, Berman, Boerner, Bonta, Bryan, Calderon, Caloza, Carrillo, Castillo, Chen, Connolly, Davies, DeMaio, Dixon, Elhawary, Ellis, Flora, Fong, Gabriel, Gallagher, Garcia, Gipson, Jeff Gonzalez, Mark González, Hadwick, Haney, Harabedian, Hart, Hoover, Irwin, Jackson, Kalra, Krell, Lee, Lowenthal, Macedo, McKinnor, Muratsuchi, Nguyen, Ortega, Pacheco, Papan, Patel, Pellerin, Petrie-Norris, Quirk-Silva, Ramos, Ransom, Celeste Rodriguez, Michelle Rodriguez, Rogers, Blanca Rubio, Sanchez, Schiavo, Schultz, Sharp-Collins, Solache, Soria, Stefani, Tangipa, Valencia, Wallis, Ward, Wicks, Wilson, Zbur, Rivas

NO VOTE RECORDED: Lackey, Patterson, Ta

Prepared by: Christian Kurpiewski / JUD. / (916) 651-4113

8/30/25 12:40:35

**** END ****

SENATE COMMITTEE ON APPROPRIATIONS

Senator Anna Caballero, Chair

2025 - 2026 Regular Session

AB 1043 (Wicks) - Age verification signals: software applications and online services

Bill Summary:

AB 1043 requires a device manufacturer to provide an interface in which the account holder of a device may input the age of the primary user of the device for the purpose of complying with age verification and parental consent laws.

Fiscal Impact:

• Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
• Unknown, potentially significant costs to the state funded trial court system (Trial Court Trust Fund, General Fund) to adjudicate civil actions. Expanding civil penalties could lead to lengthier and more complex court proceedings with attendant workload and resource costs to the court. The fiscal impact of this bill to the courts will depend on many unknowns, including the number of cases filed and the factors unique to each case. An eight-hour court day costs approximately $10,500 in staff in workload. While the courts are not funded on a workload basis, an increase in workload could result in delayed court services and would put pressure on the General Fund to fund additional staff and resources and to increase the amount appropriated to backfill for trial court operations.

Background:

The Legislature has passed numerous measures in recent years requiring businesses and social media companies to tailor their products and services to the unique needs of youth, and to protect the privacy of youth. However, some of the Legislature’s most ambitious efforts like the Age Appropriate Design Code (AB 2273 (Wicks), Chapter 320, Statutes of 2022) and the Protecting Our Kids from Social Media Addiction Act (SB 976 (Skinner) Chapter 321, Statutes of 2024) have been challenged in court, in part due to federal statutes and Constitutional law that severely constrains the ability of states to regulate online speech and platforms. As discussed in detail in the policy committee analyses, this bill seeks to avoid these legal battles and instead implement a content-neutral approach to age verification that does not dictate product design.

Proposed Law:

• Defines all of the following:
  • “Account holder” means a parent or legal guardian of a user who is under 18 years of age.
  • “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.
  • “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the sole purpose of sharing with developers of applications that indicates only any of the following:
    • Whether a user is under five years of age.
    • Whether the user is at least 5 years of age and under 10 years of age.
    • Whether the user is at least 10 years of age and under 13 years of age.
    • Whether the user is at least 13 years of age and under 16 years of age.
    • Whether the user is at least 16 years of age and under 18 years of age.
    • Whether the user is at least 18 years of age.
  • “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device.
  • “Child” means a consumer who is under 18 years of age.
  • “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing device.
  • “Covered manufacturer” means a person who is a manufacturer of a device, an operating system for a device, or a covered application store.
  • “Developer” means a person that owns, maintains, or controls an application.
  • “Online service, product, or feature” does not mean any of the following:
    • A broadband internet access service, as defined;
    • A telecommunications service, as defined; or,
    • The delivery or use of a physical product.
  • “Signal” means age bracket data or notice of parent or guardian consent sent by a real-time secure application programming interface or operating system to an application.
  • “User” means a child that is the primary user of the device.
• Requires a covered manufacturer to do all of the following:
  • Provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
  • Provide a developer who has requested a signal with respect to a particular user with a digital signal via a real-time application programming interface identifying which of the following categories pertains to the user:
    • Under five years of age;
    • At least 5 years of age and under 10 years of age;
    • At least 10 years of age and under 13 years of age;
    • At least 13 years of age and under 16 years of age;
    • At least 16 years of age and under 18 years of age; and,
    • At last 18 years of age.
  • Send only the minimum amount of information necessary to comply with this title and shall not share the digital signal information with a third party for a purpose not required by this title.
• Requires a developer to request a signal with respect to a particular user from a covered manufacturer when that user requests to download an application.
• States that a developer that receives a signal shall be deemed to have actual knowledge of the user’s age to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.
• Requires a developer to treat a signal received pursuant to this title as the primary indicator of a user’s age for purposes of determining the user’s age.
• Provides that a developer that relies in good faith on a signal provided by a covered manufacturer is presumed to have accurately determined the user’s age and to be in compliance with any state law that requires online age verification or parental guardian consent. The presumption of accuracy is rebuttable by credible evidence that the user’s age is different than the signal provided by the covered manufacturer.
• Provides that a developer that receives a signal may use that signal to comply with applicable law but shall not do either of the following:
• Request more information than the minimum amount of information necessary to comply; and,
• Share the signal with a third party for a purpose not required by this title.
• States that, a person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.
• Provides that, a covered manufacturer that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age or any conduct by a developer that receives a signal indicating a user’s age.
• Requires a covered manufacturer to comply in a nondiscriminatory manner.

-- END --

SENATE JUDICIARY COMMITTEE

Senator Thomas Umberg, Chair

2025-2026 Regular Session

Bill No: AB 1043 (Author:Wicks)

Version: May 23, 2025

Hearing Date: July 15, 2025

Fiscal: Yes

Urgency: No

Consultant: CK

SUBJECT

Age verification signals: software applications and online services

DIGEST

This bill imposes obligations on covered manufacturers to communicate certain information to developers, including age bracket information, and to obtain parental consent before allowing the download of apps for certain users. The bill requires developers to receive and treat age signals as the primary indicator of the user’s age.

EXECUTIVE SUMMARY

Children face numerous serious risks in online environments that can have lasting impacts on their development and wellbeing. Exposure to inappropriate content, including violent, sexual, or disturbing material, can be traumatic and age-inappropriate for developing minds. Cyberbullying and online harassment can lead to anxiety, depression, and social isolation, while predators may attempt to groom or exploit children through social media, gaming platforms, and messaging apps. Additionally, excessive screen time and addictive app design can interfere with sleep, physical activity, and real-world social development. Children may also inadvertently share personal information or fall victim to scams. Many approaches to solving these problems by requiring age verification have serious trade offs, whether it be privacy, security, or effectiveness.

This bill seeks to accomplish these goals by requiring manufacturers of devices, operating systems, and app stores to obtain age information on minor users and to communicate this to app developers. These “covered manufacturers” are required to get parental consent before allowing certain users to download apps from their store, as applicable. Developers are then to treat these signals as the primary indicator of a user’s age. This bill is sponsored by Children Now. It is supported by several advocacy groups, including CFT — A Union of Educators & Classified Professionals, and opposed by Chamber of Progress and Lenovo.

PROPOSED CHANGES TO THE LAW

Existing law:

1. Provides a right to free speech and expression. (U.S. Const., 1st amend; Cal. Const., art 1, § 2.)
2. Recognizes certain judicially created exceptions to the rights of freedom of speech and expression. (E.g., Virginia v. Black (2003) 538 U.S. 343, 359.)
3. Requires, pursuant to the Parent’s Accountability and Child Protection Act, a person or business that conducts business in California, and that seeks to sell any product or service in or into California that is illegal under state law to sell to a minor to, notwithstanding any general term or condition, take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser. (Civ. Code § 1798.99.1(a)(1).)
4. Establishes the CCPA, which grants consumers certain rights with regard to their personal information, including enhanced notice, access, and disclosure; the right to deletion; the right to restrict the sale of information; and protection from discrimination for exercising these rights. It places attendant obligations on businesses to respect those rights. (Civ. Code § 1798.100 et seq.)
5. Provides a consumer the right, at any time, to direct a business that sells or shares personal information about the consumer to third parties not to sell or share the consumer’s personal information. It requires such a business to provide notice to consumers, as specified, that this information may be sold or shared and that consumers have the right to opt out of that selling and sharing. (Civ. Code § 1798.120(a)-(b).)
6. Prohibits a business, notwithstanding the above, from selling or sharing the personal information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers at least 13 years of age and less than 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s personal information. A business that willfully disregards the consumer’s age shall be deemed to have had actual knowledge of the consumer’s age. (Civ. Code § 1798.120(c).)
7. Establishes the Protecting Our Kids from Social Media Addiction Act, which prohibits an operator of an addictive internet-based service or application from providing an addictive feed to a user unless they have actual knowledge that the user is not a minor or the operator has obtained parental consent. (Health & Saf. Code § 27000 et seq.)

This bill:

1. Requires a covered manufacturer to provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or both, of the user of that device for the sole purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store.
2. Requires a covered manufacturer that is a covered application store to:
   1. For a user under 16 years of age who has an account holder, obtain account holder consent before permitting the user to download an application made available through the covered application store.
   2. Provide to a developer in the covered application store a signal indicating whether an account holder who is the parent or guardian of a user under 16 years of age has provided such consent.
   3. Provide developers with the ability to disclose to the account holder information or any parental tools provided by the developer.
3. Requires a covered manufacturer to provide developers with a digital signal via a real-time application programming interface (API) identifying the age bracket of the user:
   1. Under five years of age.
   2. At least 5 years of age and under 10 years of age.
   3. At least 10 years of age and under 13 years of age.
   4. At least 13 years of age and under 16 years of age.
   5. At least 16 years of age and under 18 years of age.
   6. At least 18 years of age.
4. Requires a covered manufacturer to send only the minimum amount of information necessary to comply herewith and prohibits the sharing of the digital signal information with a third party for a purpose not required hereby.
5. Provides that a developer that relies in good faith on a signal indicating a user’s age provided by a covered manufacturer is presumed to have accurately determined the user’s age and to be in compliance with any state law that requires online age verification or parental guardian consent. This presumption is rebuttable by credible evidence that the user’s age is different than the signal.
6. Permits a developer that receives a signal indicating a user’s age to use that signal to comply with applicable law but shall not do either of the following:
   1. Request more information than the minimum amount of information necessary to comply with this title.
   2. Share the signal with a third party for a purpose not required by this title.
7. Subjects a person in violation to an injunction and to liability for a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. Such penalties are recoverable only in a civil action brought in the name of the people of the State of California by the Attorney General.
8. Provides that a covered manufacturer that makes a good faith effort to comply herewith, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age or any conduct by a developer that receives a signal indicating a user’s age.
9. Clarifies its scope and interaction with other laws.
10. Includes a severability clause.
11. Defines the relevant terms, including:
    1. “Account holder” means a parent or legal guardian of a user who is under 18 years of age.
    2. “Application” means a software application or online service, product, or feature that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device. “Online service, product, or feature” does not include a broadband internet access or telecommunications service. This also excludes the delivery or use of a physical product.
    3. “Covered application store” means a publicly available website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or other general purpose computing device.
    4. “Covered manufacturer” means a person who is a manufacturer of a device, an operating system for a device, or a covered application store.
    5. “Developer” means a person that owns, maintains, or controls an application.
    6. “Signal” means age bracket data or notice of parent or guardian consent sent by a real-time secure API or operating system to an application.
    7. “User” means a child that is the primary user of the device.

COMMENTS

1. Age verification concerns

Age verification laws have been pursued across the globe:

Government agencies, private companies, and academic researchers have spent years seeking a way to solve the thorny question of how to check internet users’ ages without the risk of revealing intimate information about their online lives. But after all that time, privacy and civil liberties advocates still aren’t convinced the government is ready for the challenge.

“When you have so many proposals floating around, it’s hard to ensure that everything is constitutionally sound and actually effective for kids,” Cody Venzke, a senior policy counsel at the American Civil Liberties Union (ACLU), tells The Verge. “Because it’s so difficult to identify who’s a kid online, it’s going to prevent adults from accessing content online as well.”

In the US and abroad, lawmakers want to limit children’s access to two things: social networks and porn sites. Louisiana, Arkansas, and Utah have all passed laws that set rules for underage users on social media. Meanwhile, multiple US federal bills are on the table, and so are laws in other countries, like the UK’s Online Safety Bill. Some of these laws demand specific features from age verification tools. Others simply punish sites for letting anyone underage use them — a more subtle request for verification.

Online age verification isn’t a new concept. In the US, laws like the Children’s Online Privacy Protection Act (COPPA) already apply special rules to people under 13. And almost everyone who has used the internet — including major platforms like YouTube and Facebook — has checked a box to access adult content or entered a birth date to create an account. But there’s also almost nothing to stop them from faking it.^[1]

A report by France’s National Commission on Informatics and Liberty (CNIL) analyzes the various approaches to age verification. It lays out various approaches but cautions that most come with dire flaws:

With regard to the devices currently available on the market, the CNIL would first like to stress that the effectiveness of age verification tools depends on the operating rules of the Internet, which is designed as an open network, freely accessible to site users and publishers. While this finding should not prevent the pursuit of the legitimate objectives of protecting minors, care should also be taken to preserve the many benefits linked to this open model (innovation, freedom of expression, user autonomy, etc.). The move towards a closed digital world, where individuals are encouraged to register mainly in authenticated universes (via the creation of user accounts) to avoid a multiplication of identity or identity attribute verifications (age, address, diplomas, etc.) presents significant risks for the rights and freedoms of individuals, which need to be taken into account.

At present, all the solutions proposed can easily be circumvented. Indeed, the use of a simple VPN locating the Internet user in a country that does not require an age verification of this order can allow a minor to bypass an age verification system applied in France, or to bypass the blocking of a website that does not comply with its legal obligations. Similarly, it is difficult to certify that the person using a proof of age is the one who obtained it.

For example, in the UK, where such measures have long been considered, 23% of minors say they can bypass blocking measures and some pornographic content publishers already offer VPN services.

If the use of VPNs must be subject to a certain vigilance, it should be stressed that such technologies are also one of the essential building blocks of the security of exchanges on the Internet, used by many companies, but also by individuals wishing to protect their browsing from the tracking conducted by public or private stakeholders.^[2]

On this latter point, the efficacy of age verification laws on the internet is drastically undercut by the ready access to VPNs. In fact, numerous laws have led to a boom in the industry, as reported by Popular Science in an article entitled “Online porn restrictions are leading to a VPN boom”:

Internet users in a handful of states across the US are finding it more difficult to browse parts of the web anonymously. Over a dozen states, including Texas and Louisiana, have enacted legislation forcing Pornhub and other purveyors of streaming online adult videos to verify the identities of its users to ensure children and teens aren’t accessing “sexual material harmful to minors.” Elsewhere, in states like Florida, lawmakers have introduced so-called online parental consent laws that would limit or ban underage users from accessing social media services over claims they cause psychological harm. In each case, lawmakers want online platforms to collect government-IDs from users or have them submit to third-party age verification methods to ensure they are indeed adults.

But determining whether or not kids and teens are actually accessing those sites means platforms have no choice but to verify the ages of all users accessing their sites, minor or otherwise. Adult porn viewers, who could previously dip in and out of websites with a relative degree of anonymity, may now fear having their government name and photograph at arms length away from their last Pornhub search query. At the same time, critics of the new laws worry some far-right, religiously conservative lawmakers could broadly interpret “adult” material to include content from LGBTQ+ creators or other people from marginalized groups who rely on the internet for a sense of community. In that scenario, teens from abusive or difficult family structures could find themselves shut out from support structures online.

Experts speaking with PopSci say there are signs internet users in many of these states are turning to Virtual Private Networks (VPNs) to access otherwise blocked materials. Leading VPN provider Top10 VPN claims demand from VPN services jumped 275% on March 15, the same day Pornhub cut off access in Texas. The site says demand for VPNs similarly surged by 210% the day after a similar law took effect in Louisiana last year. ExpressVPN, another popular VPN provider, told PopSci it saw increased web traffic to its site the day anti-porn, online age verification bills took effect in seven out of eight states. . . .

VPNs, which date back to the mid 1990s, create an encrypted tunnel for user’s data and can make it appear as if their computer is based in a different geographical location.^[3]

1. First Amendment, third rail

The elephant in the room with such age verification laws is the First Amendment to the United States Constitution. The First Amendment, as applied to the states through the Fourteenth Amendment, prohibits Congress or the states from passing any law “abridging the freedom of speech.”^[4] “[A]s a general matter, the First Amendment means that government has no power to restrict expression because of its message, its ideas, its subject matter, or its content.”^[5] However, while the amendment is written in absolute terms, the courts have created a handful of narrow exceptions to the First Amendment’s protections. Expression on the internet is given the same measure of protection granted to in-person speech or statements published in a physical medium.^[6]

A constitutional challenge to a restriction on speech is generally analyzed under one of two frameworks, depending on whether the courts deem it to be “content neutral” or “content based,” i.e., targeting a particular type of speech. A law is content neutral when it “serves purposes unrelated to the content of the expression.”^[7] On the other hand, a law is content based when the proscribed speech is “defined solely on the basis of the content of the suppressed speech.”^[8]  If a restriction on speech is determined to be content based, it will be subject to strict scrutiny.^[9] A restriction is content based “if it require[s] ‘enforcement authorities’ to ‘examine the content of the message that is conveyed to determine whether’ a violation has occurred.”^[10] Content-based restrictions subject to strict scrutiny are “presumptively unconstitutional.”^[11] A restriction can survive strict scrutiny only if it uses the least-restrictive means available to achieve a compelling government purpose.^[12]

Specifically with reference to regulation of sexual content online, the United States Supreme Court in Reno v. ACLU (1997) 521 U.S. 844, 849 invalidated provisions of the Communications Decency Act of 1996 that established criminal penalties for the knowing transmission of obscene or indecent material in a manner likely to be accessible to a minor. Under the statute, an affirmative defense was available to “those who restrict access to covered material by requiring certain designated forms of age proof, such as a verified credit card or an adult identification number or code.”^[13] Stressing the vagueness and breadth of the statute, the Supreme Court reiterated the principle that the government’s interest in protecting children “does not justify an unnecessarily broad suppression of speech addressed to adults.”^[14] The court also relied on the lower court’s findings that there was no effective way to verify a user’s age:

As a practical matter, the Court also found that it would be prohibitively expensive for noncommercial--as well as some commercial--speakers who have Web sites to verify that their users are adults. These limitations must inevitably curtail a significant amount of adult communication on the Internet. By contrast, the District Court found that “despite its limitations, currently available user-based software suggests that a reasonably effective method by which parents can prevent their children from accessing sexually explicit and other material which parents may believe is inappropriate for their children will soon be widely available.”^[15]

Congress responded by passing the Child Online Protection Act (COPA), which imposed criminal penalties on operators of websites that knowingly post, for commercial purposes, material that is “harmful to minors.”^[16] An affirmative defense, again, was available for those who take reasonable measures to prevent minors from accessing the website, including age verification.^[17] In Ashcroft v. ACLU (2004) 542 U.S. 656, the United States Supreme Court affirmed the lower court’s ruling that enforcement of the law should be suspended during a pending lawsuit because the statute likely violated the First Amendment. Applying strict scrutiny, the Court found that COPA was likely unconstitutional because content filters installed on computers by parents were less restrictive and more likely to be effective than age verification.^[18]

Recently, a Texas law seeking to impose age verification requirements on pornographic websites was challenged, in part, on First Amendment grounds. The United States District Court for the Western District of Texas, relying on Reno and Ashcroft, subjected the bill to strict scrutiny and found it violated the First Amendment.^[19] However, on appeal, the Fifth Circuit Court of Appeals refused to apply the above Supreme Court precedent, and applied a rational basis test, which asks whether a speech restriction is rationally related to the government’s legitimate interest, a much less exacting standard.^[20] Overturning the lower court’s ruling, the court found that the law did not violate the First Amendment. The case was appealed to the U.S. Supreme Court, which, just a few weeks ago, issued its opinion on the case.^[21] It applied an entirely different standard, subjecting the law to intermediate scrutiny. The opinion, authored by Justice Clarence Thomas, found that the “power to require age verification is within a State’s authority to prevent children from accessing sexually explicit content” and that the Texas law was a constitutionally permissible exercise of that authority. While this law was specifically focused on sexually explicit content, it provides context for the bill at hand.

The First Amendment has been the third rail for a number of laws passed by California in recent years. SB 976 (Skinner, Ch. 321, Stats. 2024) prohibited operators of “internet-based services or applications” from providing “addictive feeds,” as those terms are defined, to minors without parental consent and from sending notifications to minors at night and during school hours without parental consent, as provided. SB 976 required operators to make available to parents a series of protective measures for controlling access to and features of the platform for their children. It also required reporting on data regarding children on their platforms, as specified. Most relevant here, it required operators to reasonably determine that a user is not a minor before providing access. The law was almost immediately challenged and a federal district court has partially enjoined it, finding that elements of the law are likely to infringe upon the First Amendment. However, the court found the challenge to the age assurance provisions not prudentially ripe.^[22] The litigation is ongoing.

AB 2273 (Wicks, Ch. 320, Stats. 2022) established the California Age-Appropriate Design Code Act, placing a series of obligations and restrictions on businesses that provide online services, products, or features likely to be accessed by children. This includes a prohibition on using the personal information of any child in a way that the business knows or has reason to know is materially detrimental to the physical health, mental health, or well-being of a child. Relevant here, the law also requires these businesses to “[e]stimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or apply the privacy and data protections afforded to children to all consumers.” The law was also challenged on First Amendment grounds. The federal district court applied the facial First Amendment challenge analysis prescribed in Moody v. NetChoice, LLC (2024) 603 U.S. 707, a case challenging social media laws in Florida and Texas. The court enjoined much of the law on First Amendment grounds. The plaintiff asserted that the “age estimation requirement would prevent covered businesses from providing expressive content protected by the First Amendment to both children and adults, and likewise would prevent children and adults from accessing expressive content protected by the First Amendment.” The court held:

By requiring a business to estimate age for the purpose of determining what content is appropriate for that age, the CAADCA imposes limits on the content a covered business may publish and the content each user may view. In the alternative, all content must be sanitized to comport with the highest risk level, presumably, the youngest children. Imposing restrictions of that nature with respect to content published to, and accessed by, both children and adults would trigger strict scrutiny of this provision . . . .

The State’s argument is grounded in an assumption that greater data privacy for children means greater security and well-being. As NetChoice points out, however, the State ignores that the age estimation requirement will require businesses to collect private information that users may not wish to share. One of NetChoice’s declarants, Stacie Rumenap of the nonprofit organization Stop Child Predators, opines that the practical effect of the CAADCA’s age estimation requirement is that businesses will gather and create “a trove of sensitive data” regarding children. Ms. Rumenap considers it “an inevitability, given the realities of data security, that one or more of these data sets will be breached, exposing the personal information of children to bad actors.”

. . .
On this record, the Court finds that the State has not met its burden to show that age estimation furthers its interest in the privacy and well-being of children.

If a business chooses not to estimate the age of its users, it must apply the privacy and data protections afforded to children to all consumers. However, the Supreme Court has made clear that under the First Amendment, a state “could not reduce the adult population . . . to reading only what is fit for children.” “A statute that effectively suppresses a large amount of speech that adults have a constitutional right to receive and to address to one another . . . is unacceptable if less restrictive alternatives would be at least as effective in achieving the legitimate purpose that the statute was enacted to serve.” While the State asserts that there are no less restrictive alternatives, it fails to carry its burden on that point because its statement is not supported by any evidence.

Based on the foregoing, the Court finds that § 1798.99.31(a)(5) likely fails strict scrutiny. At the first step of the Moody analysis, the Court finds that the provision will impose the same barriers to speech on all covered businesses and their audiences. Every covered business will be forced to choose between intruding into user privacy, thereby chilling publication of and access to protected speech, or publishing only child-appropriate content, thereby restricting access to protected speech for users of all ages. The State has not demonstrate[d] that this choice is narrowly tailored to advance the well-being of children. At the second step of Moody, the Court finds that because all applications of § 1798.99.31(a)(5) will impose barriers to protected speech, the provision has no legitimate sweep.

Accordingly, the Court concludes that NetChoice is likely to prevail on its claim of facial invalidity with respect to California Civil Code § 1798.99.31(a)(5).^[23]

1. Establishing the Digital Age Assurance Act

Practical concerns with establishing some level of age assurance have been asserted by the industry. The issue is how each individual developer of applications or online services, products, and features can effectively and appropriately identify the age of users in order to cater their products and services, or to restrict access to them, for children. A recent report by the Family Online Safety Institute (FOSI), an international nonprofit counting many of the major developers and technology companies as members, has teed up the issue:

As concerns about online safety proliferate, one proposed approach for keeping children safer online is the deployment of age assurance tools capable of estimating or verifying the ages of users. Assessing a person’s age online is complicated, particularly when it comes to children and minors. This issue has perplexed the creators of websites, platforms, apps, and games since the early days of the Internet.^[24] 

FOSI’s “Coming to Terms with Age Assurance” report outlines the major challenges in this space:

Challenges

Proportionality

• Proportionality refers to the use of a risk-based scale to determine which age assurance methods will best minimize online harms to kids.
• Establishing a risk-based and proportional approach to age assurance is one of the most consistent and important ideas that has coalesced from research, expert interviews, and best practices.
• The challenge in developing policies around this approach is particularly difficult due to lack of consensus on what the risk levels are for different types of online experiences, and for different ages of kids.
• It’s important to thoughtfully develop a regulatory roadmap that will steadily and reliably reduce harm and uncertainty, rather than mandate a rushed approach.

Variety of services

• The tech industry is composed of thousands of companies that offer a variety of services. The challenge of determining a user’s age so they can safely access, create, and communicate using those services varies according to the context.
• There is considerable complexity to the process that must happen internally within companies before the public is ever asked for their age. Policy, privacy, and product teams must align in a way that will make age assurance goals possible.

Safety vs. privacy

• A key tension within age assurance is finding a balance between safety and privacy.
• When it comes to age assurance, the more effective a method of verification is, the more data is required. It is not possible to fully verify a person’s age without collecting any personal data.
• The variety of methods currently available range from those requiring hard identifiers (such as government issued IDs), to the use of AI and machine learning technologies that can assess an age range. No singular method addresses every concern, and each must be considered individually.

Transparency

• A critical factor in the acceptance of any approach to age assurance will be consumer buy-in.
• Industry will need to convince users that they will only use an individual’s identifying information for age estimation purposes and that they will dispose of such information or retain it securely.^[25]

This bill seeks to navigate these challenges by placing age assurance responsibility at the manufacturer level. The bill places a series of obligations on “covered manufacturers,” defined as manufacturers of devices, operating systems for devices, or covered application stores. “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing device. “Application” is broadly defined to mean a software application or online service, product, or feature that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device.

At account setup, covered manufacturers are required to provide an interface that requires an “account holder,” the parent or guardian of a minor user, to indicate the birthdate or age of the user of the relevant device. This information is to be used solely to send a digital signal to a developer, a person that owns, maintains, or controls an application, via a real-time API identifying the relevant age bracket of the minor user. The relevant age brackets are:

• Under 5 years of age.
• 5 to 9 years of age.
• 10 to 12 years of age.
• 13 to 15 years of age.
• 16 or 17 years of age.
• 18 years of age or older.

If the manufacturer is a covered application store, several additional obligations are imposed. First, if the user is under 16 years of age, the manufacturer must get parental consent before allowing a user to download an application through the covered application store and must communicate whether this consent has been obtained to the developer. These manufacturers must also provide developers with the ability to disclose to the account holder information or any parental tools provided by the developer.

Developers are required to treat these age signals as the primary indicator of a user’s age and are deemed to have actual knowledge of the user’s age when it receives the signal. A developer with actual knowledge of a user’s age is required to connect account holders with any existing tools to support a user with respect to the user’s use of the service and as appropriate given the risks that arise from use of the application. The bill establishes a presumption that a developer has accurately determined the user’s age and is in compliance with any state law that requires online age verification or parental guardian consent if it relies in good faith on the digital signal provided by a manufacturer. However, this presumption can be rebutted by credible evidence that the user’s age is different than that indicated by the manufacturer’s signal.

For the privacy and security of users, covered manufacturers must send only the minimum amount of information necessary for compliance herewith. For their part, developers are to use this information to comply with the law but are prohibited from requesting more information than is necessary for compliance. Both manufacturers and developers are prohibited from sharing these digital signals with third parties for any purpose not required by this bill.

A person that violates any of these provisions is subject to an injunction and liable for a modest civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. Such remedies can only be sought in actions brought by the Attorney General. The bill further provides a broad safe harbor for covered manufacturers who make “a good faith effort to comply,” taking into consideration available technology and any reasonable technical limitations or outages. In such instances, the manufacturer is immunized from liability for any erroneous age signal and any conduct by a developer relying on that erroneous signal.

1. A method for age assurance that mitigates age verification concerns

According to the author:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

This bill is aimed at avoiding the pitfalls and challenges of the variety of approaches to age verification highlighted above. First, it contains a number of privacy protective features that avoid schemes that might require government identification or invasive biometric data collection. The account holder simply provides the birthdate or age of the user. The manufacturer is the only entity that should receive this specific information. Thereafter, developers are provided the age bracket of the user. Both parties are prohibited from sharing this information for other purposes and no more information than is minimally necessary to comply with the law is allowed to be provided or requested.

Second, it balances the various interests and still maintains a level of reliability, unlike simple self-certification at each point of contact for users. As aptly put in the Assembly Judiciary Committee analysis of the bill:

Although the age input may not be verified through biometric scans or identity documents, the signal is designed to reflect good-faith entries by a parent or guardian and, importantly, cannot later be modified by the user. Minors are therefore unable to change their signal or input false information later in an attempt to bypass parental controls or age-based restrictions. Likewise, developers and applications cannot spoof or overwrite the signal. This infrastructure is intentionally designed to be both privacy-preserving and resistant to circumvention.

Finally, the bill’s approach is much more insulated from constitutional challenge than some of its predecessor bills that have sought to protect children online, including AB 2273, discussed above. This bill does not require any restriction be imposed by developers as a result of this information or require any content moderation or design changes. It simply requires developers to connect the relevant account holders with existing tools to support a minor user.

The vision of the bill is for these signals to be used to comply with any other laws that require specific treatment of children online. The bill creates certainty by establishing a presumption in favor of developers, providing: “A developer that relies in good faith on a signal indicating a user’s age provided by a covered manufacturer is presumed to have accurately determined the user’s age and to be in compliance with any state law that requires online age verification or parental guardian consent.” However, to ensure the main goals of these laws are properly effectuated, the bill includes a mechanism for rebutting the presumption where there is credible evidence to the contrary. In addition, even if the developer willfully disregards the signal, they will be deemed to have actual knowledge of the user’s age.

It should be noted that the provision requiring manufacturers that are application stores to get parental consent before a user under the age of 16 is able to download any application is distinct from the rest of the bill in terms of First Amendment analysis. This provision does specifically limit access to lawful speech and limits the content that can be offered to users based on age. It does not even differentiate between apps that are properly targeted at children or that provide resources for at-risk youth. Therefore, it may be more susceptible to challenge.

Arguably, device-level verification creates a more comprehensive safety net by establishing a framework through which parental controls and content filters can be consistently applied across apps and websites, rather than relying on individual platforms’ and developers’ varying standards. This approach could enable automatic blocking of inappropriate content, limit data collection from minors, and provide parents with better visibility and control over their children’s digital experiences. Furthermore, device-level age verification could facilitate access to educational content and age-appropriate social features while maintaining stronger privacy protections, ultimately creating a more secure digital environment that supports healthy child development without completely restricting beneficial online activities.

1. Stakeholder concerns

Concerns have been raised about various components of this proposed regulatory framework. Some stakeholders have called for provisions that more specifically spell out the technical details regarding the digital interactions between covered manufacturers and developers. In response, the author has agreed to amendments that make clear a covered manufacturer is to provide developers a user’s age bracket signal when the developer requests the signal. The developer is required to so request the signal when a user requests to download an application. The developer is then deemed to have actual knowledge of the user’s age across all platforms of the application and points of access of the application.

Other stakeholders have asked for amendments that ensure developers can continue to enforce their terms of service relating to age restrictions. Several stakeholders have requested express carve outs where certain age assurance protocols are already in place or, in the alternative, amendments that significantly scale back the definitions of developer, application, and/or covered application store.

One concern in particular is with the scope of the definition of “application” to include an “online service, product, or feature.” In response, the author has agreed to amendments that remove this portion of the definition, narrowing significantly the scope of the bill. The understanding is this is being done to allow more time to properly address technical concerns with applying the provisions of this bill so broadly.

Writing in opposition, Chamber of Progress argues:

While it is important to encourage parental involvement to ensure minors’ safety online, parents are not always best suited to control how their child uses a platform. AB 1043 risks harming the very children it aims to protect, especially vulnerable youth. Many apps that provide critical services, such as platforms supporting mental, physical, and reproductive health, prioritize anonymity to ensure user safety and promote positive, help-seeking behaviors. Age-bracket signaling and automatic parental consent and control requirements, as outlined in AB 1043, could pressure app stores to collect more information, compromising privacy.

In situations where a parent does not support their child’s identity or seeks to restrict access to certain political, health, or other information, this authority can be utilized and weaponized as a tool of control, particularly in abusive or unhealthy home environments. For many youth, online spaces serve as a lifeline, offering access to communities, resources, and support networks that may not be available in their offline lives. LGBTQ+ youth, especially those who may live in communities hostile to their identity, see social media as a crucial tool to connect with LGBTQ+ groups, access content from people’s shared experiences, maintain positive connections, and reduce perceived isolation. LGBTQ+ youth use online platforms to seek emotional support, search for information about their identities, and find communities that accept them when their own parents do not. In fact, only 38% of LBGTQ youth report living in affirming households, while 60% reported finding online spaces to be supportive.

In response to these concerns, and the First Amendment implications discussed above, the author has agreed to amendments that remove the parental consent requirements in the bill, and the attendant provisions regarding connecting account holders with existing tools.

1. Stakeholder support

Children Now, the sponsor of the bill, writes:

The mental health of youth is in crisis. The challenges that families have faced for generations are exacerbated and amplified by modern technology. Parents, schools and governments are all grappling with the challenges of how to keep kids safe online. Simultaneously, connectivity provides opportunity for access to friends, family, community, and resources.

By sharing approximate users’ age to developers of online products and services, AB 1043 will ensure that online platforms provide age-appropriate online experiences. AB 1043 marks an important step toward creating a developmentally safe online world that supports youths’ mental, emotional, and social development.

CFT writes in support:

Young people are struggling like never before. Challenges families have faced for generations are now intensified by modern technology, exposing young people to cyberbullying, sextortion, trafficking, harmful drugs, and abuse, both online and offline. Behind the screen, platforms mine the personal data of young people to build complex profiles used for targeted advertising and to addict kids to their screens. At the same time, connectivity offers valuable opportunities for connection, community and support. AB 1043 offers a responsible, secure, privacy-first solution that protects young people while preserving those benefits.

SUPPORT

Children Now (sponsor)
California Catholic Conference

California Civil Liberties Advocacy

California Parents for Public Virtual Education

CFT- a Union of Educators & Classified Professionals, AFT, AFL-CIO

#HalfTheStory

Parent Support for Online Learning

The Source LGBT+ Center

OPPOSITION

Chamber of Progress

Lenovo, Inc.

RELATED LEGISLATION

Pending Legislation:

AB 2 (Lowenthal, 2025) increases the penalties that can be sought against a social media platform, as defined, if the platform fails to exercise ordinary care or skill and injures a child. AB 2 is currently in this Committee and is set to be heard the same day as this bill.

AB 56 (Bauer-Kahan, 2025) requires social media platforms to clearly display warning labels about the harms associated with social media when users enter the platform and after extended use, as provided. AB 56 is currently in the Senate Health Committee.

Prior Legislation:

SB 976 (Skinner, Ch. 321, Stats. 2024) See Comment 2.

AB 1949 (Wicks, 2024) would have prohibited collecting, sharing, selling, using, or disclosing the personal information of minors without affirmative consent from either the minor or their parent or guardian, as provided. It would have required businesses to treat a consumer as under 18 years of age if the consumer, through a platform, technology, or mechanism, transmits a signal indicating that the consumer is less than 18 years of age. AB 1949 was vetoed by Governor Newsom, who stated: “[T]his bill would fundamentally alter the structure of the CCPA to require businesses, at the point of collection, to distinguish between consumers who are adults and minors. I am concerned that making such a significant change to the CCPA would have unanticipated and potentially adverse effects on how businesses and consumers interact with each other, with unclear effects on children’s privacy.”

AB 3080 (Alanis, 2024) would have required a person or business that makes available products that are illegal to make available to minors, including pornographic internet websites, to take reasonable steps to ensure the user is of legal age at the time of access, including by verifying the age of the user. AB 3080 died in the Senate Appropriations Committee.

AB 2273 (Wicks, Ch. 320, Stats. 2022) See Comment 2.

PRIOR VOTES:

Assembly Floor (Ayes 76, Noes 0)

Assembly Appropriations Committee (Ayes 11, Noes 0)

Assembly Judiciary Committee (Ayes 12, Noes 0)

Assembly Privacy and Consumer Protection Committee (Ayes 13, Noes 0)

**************

1. Emma Roth, Online age verification is coming, and privacy is on the chopping block (May 15, 2023) The Verge, https://www.theverge.com/23721306/online-age-verification-privacy-laws-child-safety. ↑

2. Online age verification: balancing privacy and the protection of minors (September 22, 2022) CNIL, https://www.cnil.fr/en/online-age-verification-balancing-privacy-and-protection-minors. ↑

3. Mack Degeurin, Online porn restrictions are leading to a VPN boom (April 3, 2024) Popular Science, https://www.popsci.com/technology/vpn-boom/. ↑

4. U.S. Const., 1st & 14th amends. ↑

5. Ashcroft v. American Civil Liberties Union (2002) 535 U.S. 564, 573. ↑

6. Reno v. ACLU (1997) 521 U.S. 844, 870. ↑

7. Ward v. Rock Against Racism (1989) 491 U.S. 781, 791.   ↑

8. FCC v. League of Women Voters (1984) 468 U.S. 364, 383.  ↑

9. McCullen v. Coakley (2014) 573 U.S. 464, 478.  ↑

10. Id. at p. 479. ↑

11. Reed v. Town of Gilbert (2015) 135 S.Ct. 2218, 2226 (Reed). ↑

12. United States v. Playboy Entertainment Group (2000) 529 U.S. 803, 813. ↑

13. Reno, 521 U.S. at pp. 860-861. ↑

14. Id. at p. 875. ↑

15. Id. at pp. 876-877. ↑

16. Ashcroft v. ACLU 542 U.S. at p. 661. ↑

17. Id. at p. 662. ↑

18. Id. at p. 673. ↑

19. Free Speech Coal., Inc. v. Colmenero (W.D. Tex. 2023) 689 F. Supp. 3d 373, 391. ↑

20. Free Speech Coal., Inc. v. Paxton (5th Cir. 2024) 95 F.4th 263. ↑

21. Free Speech Coal., Inc. v. Paxton (2025) 606 U.S. ___ 2025, U.S. LEXIS 2497, *6. ↑

22. NetChoice v. Bonta (N.D. Cal. 2024) 761 F. Supp. 3d 1202, 1218. ↑

23. NetChoice, LLC v. Bonta (N.D. Cal. 2025) 769 F. Supp. 3d 1164. ↑

24. Coming to Terms with Age Assurance (July 2023) FOSI, https://fosi.org/wp-content/uploads/2025/03/64b0011a158eea37fb7796c4_FOSI-White-Paper-Coming-to-Terms-with-Age-Assurance-FOR-WEBSITE.pdf. ↑

25. Ibid. ↑

ASSEMBLY THIRD READING

ATR Bill Id:AB 1043

Author:(Wicks)

As Amended Ver:May 23, 2025

Majority vote

SUMMARY

Establishes the Digital Age Assurance Act, which creates a signaling infrastructure that allows developers to rely on a real-time, secure indicator of a user′s age bracket for purposes of complying with other California laws that require age verification or parental consent.

Major Provisions

1. Defines ″Age bracket data″ to mean nonpersonally identifiable data derived from a user′s birth date or age that indicates only the following:
   1. Whether a user is under five years old.
   2. Whether a user is at least five, but under 10 years old.
   3. Whether a user is at least 10, but under 13 years old.
   4. Whether a user is at least 13, but under 16 years old.
   5. Whether a user is at least 16, but under 18 years old.
   6. Whether a user is at least 18 years old.
2. Requires a manufacturer of a device or an operating system do all of the following:
   1. Provide an accessible interface that allows device owners, upon device setup, to indicate the birth date, age, or both, of the user of the particular device.
   2. If the manufacturer is also an application store, the manufacturer is required to:
      1. Obtain parent or guardian consent before permitting a user under 16 to download an application.
      2. Provide a signal in the application store indicating whether a parent or guardian has provided consent.
   3. Provide developers with the ability to disclose to the account holder information or any parental tools provided.
   4. Provide application developers with a digital signal signaling whether or not a user is in any of the age brackets.
3. Requires an application developer that has actual knowledge of a user′s age to connect account holders with existing tools to support a child user′s use of the application.
4. States that a signal is presumed to be accurate and that a developer may rely on the signal for the purpose of compliance with any state law that requires age verification or parental consent.
5. Creates a civil action that can be brought by the Attorney General.
6. States that the protections provided by this title are in addition to those provided by any other applicable law, including the California Age-Appropriate Design Code Act.

COMMENTS

Children today spend more time online than any generation before them—but the internet was not built with them in mind. While minors increasingly rely on digital platforms for education, entertainment, and socialization, they are routinely exposed to harms including exploitative content, manipulative design features, and addictive engagement mechanisms.

Although federal action is ultimately needed to standardize protections across jurisdictions, California′s status as a tech capital and economic giant allows it to lead by example, often setting de facto national standards. The Digital Age Assurance Act (AB 1043) is the latest in a long lineage of California′s efforts to protect its children from online harms. The bill attempts to do this by offering an infrastructure-level solution that avoids direct content regulation while enabling other child protection laws to function effectively.

California has enacted or proposed several laws to better protect minors in digital spaces, but enforcement and implementation remain stymied by a basic infrastructure gap: there is no standardized, privacy-preserving method for determining whether a user is a child. AB 1043, the Digital Age Assurance Act, seeks to fill that gap by establishing a secure signaling framework at the device and app store level. This framework allows developers to receive a tamper-resistant digital signal reflecting a user′s age bracket—without requiring the collection of personal data or documents—and to treat that signal as the authoritative indicator of a user′s age for compliance purposes under California law.

Striking a balance between parental control and children′s privacy. In protecting children from the potential harms on the internet, like those discussed previously, there must be a careful balance between appropriate parental control and the rights of older teens to access certain platforms. At the core of this bill is a conceptually elegant solution for establishing the age of the user. By sending an age assurance signal that developers are required to rely on for having actual knowledge of the age of the user, provides a number of significant benefits:

1. It alleviates concerns from privacy advocates that age verification would necessarily require everyone to provide developers and platforms with even greater sensitive personal information by having to upload official identification documents in order to prove that they are old enough to access the application or the content.
2. It potentially removes the argument from the technology industry that have no definitive way of knowing the age of their users, thus allowing them to avoid responsibility for allowing children to access harmful content. As an example, applications that are restricted to adults generally simply ask the user to attest to whether or not they are old enough to access the site. With an age assurance signal, the platforms would be provided with actual knowledge of the age or age range of the user that they could then rely on to grant or deny access.
3. The State′s consumer privacy law, the California Consumer Privacy Act, restricts the ability of businesses to be able to use, share, or sell personal information on minors. For those under 13, parental consent is required for the sharing or sale of a child′s information, for those older children who are at least 13, but under 16, they must consent to having their personal information shared and sold. However, those restrictions only apply if a business has actual knowledge of the person′s age. An age assurance signal sent to online businesses could provide that actual knowledge.

However, this bill juggles both technical complexity and sensitive issues around parental control and children′s privacy and autonomy, raising questions about the right solutions for younger children versus more mature teens.

According to the Author

California′s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children′s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user′s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children′s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

Arguments in Support

The International Centre for Missing and Exploited Children (ICMEC), co-sponsors of the bill, write in support:

ICMEC views the device-based mechanism outlined in AB 1043 not as a solution that benefits one industry over the other, but rather as the most common sense and feasible solution. It is an industry-wide solution that holds all online services accountable in the online journey of a child.

Rather than providing personal information to dozens of websites and applications, all of which may have varying levels of security and privacy practices, the mechanism in AB 1043 centralizes the point at which age is requested at the lowest common denominator: on the device itself.

This mechanism is a technically feasible and constitutionally sound method that protects the privacy of both adult and child users. You are not disclosing the identity of a child or adult; once a user enters their age on their device, they are wrapped in a shroud of privacy that provides websites and applications only with a user′s age range. This bill will provide a critical tool to protect vulnerable children in California, children whose parents may not be involved or aware of their child′s digital experience.

Arguments in Opposition

In opposition to the prior version of the bill, TechNet argues:

AB 1043 requires app store providers to verify the age of users before granting access to app downloads, purchases, or usage. Age verification is a complex challenge to address and requires consideration of how to properly balance the interests of privacy and security. Stringent age verification measures could necessitate the collection, processing, and storage of sensitive personal information, such as birth dates and government-issued identification. This could conflict with data privacy principles like privacy-by-design and data minimization and create new vectors for fraud, as every user in the state must prove whether or not they are a minor.

Additionally, there are privacy concerns associated with the bill′s parental consent requirements. Parental consent entails verifying parental relationships and parental rights, which will likely lead to privacy-invasive processes beyond collecting and verifying the age of an individual. For example, even with a birth certificate, there are custody agreements and other issues that could prevent a caregiver listed on that certificate from exercising parental rights to provide consent. Additionally, the bill is silent on the specific methodologies that would be sufficient to obtain and verify parental consent as well as parental relationships and rights, leading to compliance uncertainty and potential legal vulnerabilities.

FISCAL COMMENTS

1. Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount. Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload. If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum. If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate cases filed under the new cause of action created by this bill. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour. Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.

VOTES

ASM PRIVACY AND CONSUMER PROTECTION: 13-0-2

YES: Bauer-Kahan, Dixon, Bryan, Irwin, Lowenthal, Macedo, McKinnor, Ortega, Pellerin, Petrie-Norris, Ward, Wicks, Wilson

ABS, ABST OR NV: DeMaio, Patterson

ASM JUDICIARY: 12-0-0

YES: Kalra, Dixon, Bauer-Kahan, Bryan, Connolly, Harabedian, Macedo, Pacheco, Papan, Sanchez, Stefani, Zbur

ASM APPROPRIATIONS: 11-0-4

YES: Wicks, Arambula, Calderon, Caloza, Elhawary, Fong, Mark González, Hart, Pacheco, Pellerin, Solache

ABS, ABST OR NV: Sanchez, Dixon, Ta, Tangipa

UPDATED

VERSION: May 23, 2025

CONSULTANT: Julie Salley / P. & C.P. / (916) 319-2200 FN: 0000930

Date of Hearing: May 7, 2025

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Buffy Wicks, Chair

ABPCA Bill Id:AB 1043

Author:(Wicks) – As Amended Ver:April 24, 2025

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires a device manufacturer to provide an interface in which the account holder of a device may input the age of the primary user of the device. The user’s age indicator must be signaled to application developers for the purpose of complying with age verification and parental consent laws.

A violation of the bill’s requirements is enforceable through a civil action brought by the Attorney General. The bill establishes civil penalties of $2,500 for each negligent violation and $7,500 for each intentional violation.

FISCAL EFFECT:

1. Possible costs (General Fund, special funds) to the Department of Justice (DOJ) of an unknown amount.  Actual costs will depend on whether the Attorney General pursues enforcement actions, and, if so, the level of additional staffing DOJ needs to handle the related workload.  If DOJ hires staff to handle enforcement actions authorized by this bill, the department would incur significant costs, likely in the low hundreds of thousands of dollars annually at a minimum.  If DOJ does not pursue enforcement as authorized by this bill, the department would likely not incur any costs.
2. Cost pressures (Trial Court Trust Fund, General Fund) of an unknown but potentially significant amount to the courts to adjudicate cases filed under the new cause of action created by this bill. Actual costs will depend on the number of cases filed and the amount of court time needed to resolve each case. It generally costs approximately $1,000 to operate a courtroom for one hour.

Although courts are not funded on the basis of workload, increased pressure on the Trial Court Trust Fund may create a demand for increased funding for courts from the General Fund. The fiscal year 2024-25 state budget provides $37.3 million ongoing General Fund to backfill declining revenue to the Trial Court Trust Fund.

COMMENTS:

1. Purpose. According to the author:

Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

1. Background. The Legislature has passed numerous measures in recent years requiring businesses and social media companies to tailor their products and services to the unique needs of youth, and to protect the privacy of youth. However, some of the Legislature’s most ambitious efforts – like the Age Appropriate Design Code (AB 2273 (Wicks), Chapter 320, Statutes of 2022) and the Protecting Our Kids from Social Media Addiction Act (SB 976 (Skinner) Chapter 321, Statutes of 2024) – have been challenged in court, in part due to federal statutes and Constitutional law that severely constrains the ability of states to regulate online speech and platforms.

As discussed in detail in the analysis of this bill by the Assembly Committee on Judiciary, this bill seeks to avoid these legal battles and instead implement a content-neutral approach to age verification that does not dictate product design. This bill requires device manufacturers to provide an interface in which the account holder of a device (most commonly, a parent) may input the age of the primary user of the device. The user’s age is translated into a digital signal that indicates which age bracket the user falls into – for example, under 5 years old, five to nine years old, or 10 to 12 years old. An app developer that receives a user’s age signal must treat it as the authoritative indicator of the user’s age (absent evidence to the contrary) for the purposes of complying with other laws regarding age verification, parental consent, and data privacy.

Analysis Prepared by: Annika Carlson / APPR. / (916) 319-2081

Date of Hearing: April 29, 2025

ASSEMBLY COMMITTEE ON JUDICIARY

Ash Kalra, Chair

ABPCA Bill Id:AB 1043

Author:(Wicks) – As Amended Ver:April 24, 2025

SUBJECT: Age verification signals: software applications and online services

KEY ISSUE: SHOULD CALIFORNIA ADOPT AN AGE ASSURANCE FRAMEWORK THAT REQUIRES MANUFACTURERS AND APP STORES TO GENERATE A SIGNAL OF USER’S AGE BRACKET, AND REQUIRE DEVELOPERS TO TREAT THAT SIGNAL AS THE AUTHORITATIVE INDICATOR OF AGE FOR THE PURPOSE OF COMPLYING WITH STATE LAWS REQUIRING AGE VERIFICATON OR PARENTAL CONSENT?

SYNOPSIS

This bill responds to mounting concern over the impact of unregulated digital environments on children by establishing the Digital Age Assurance Act, a statutory framework that enables application developers to rely on upstream, device-level age signals when fulfilling their obligations under state laws regarding minors and online access. Specifically, the bill requires covered manufacturers—including device and operating system providers and application stores—to provide an interface prompting the device owner to enter the user’s birthdate or age at setup. This information is then converted into a non-identifiable “signal” indicating the user’s age bracket (e.g., under 5, 5–9, etc.), which is transmitted in real-time via a secure API (Application Programming Interface) to application developers. For covered application stores, the bill imposes additional requirements, including obtaining verifiable parental consent before allowing children under 16 to download an app, and transmitting a signal confirming that such consent has been received. Upon receiving a signal indicating that a user is a child, developers are deemed to have “actual knowledge” of the user’s age and must activate any available parental control tools as appropriate to the risks of the application—such as screen time limits, linked accounts, or age-appropriate content settings. Developers must treat the signal as the authoritative indicator of age for purposes of any California law requiring age verification or parental consent and are afforded a rebuttable presumption of compliance if they rely on the signal in good faith. AB 1043 is deliberately designed to avoid the First Amendment and Section 230 concerns that led courts to enjoin earlier legislative efforts (e.g., AB 2273 and SB 976). It imposes no speech or design mandates, no compelled disclosures, and no access restrictions. Instead, it creates a constitutionally cautious, interoperable infrastructure that supports compliance with other laws. While it does not mandate platform changes, the bill provides clarity and consistency by assigning responsibility to manufacturers to generate and transmit age signals, and allowing developers to rely on those signals without engaging in invasive data collection or biometric verification. Enforcement is limited to civil penalties recoverable by the Attorney General. Recent amendments further clarify that receipt of the signal constitutes actual knowledge of a child user, and that obligations only attach to developers if relevant features already exist. This measure is sponsored by Children Now and the International Center for Missing and Exploited Children. It is opposed by the Chamber of Progress, TechNet, and Oakland Privacy. This measure passed out of the Assembly’s Committee on Privacy and Consumer Protection by a 13-0 vote.

SUMMARY: Establishes the Digital Age Assurance Act, which creates a signaling infrastructure that allows developers to rely on a real-time, secure indicator of a user’s age bracket for purposes of complying with other California laws that require age verification or parental consent. Specifically, this bill:

1. Defines the following:
   1. “Account holder” means a parent or legal guardian of a device user who is under 18 years of age.
   2. “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age that indicates only the following:
      1. Whether a user is under five years old.
      2. Whether a user is at least five, but under 10 years old.
      3. Whether a user is at least 10, but under 13 years old.
      4. Whether a user is at least 13, but under 16 years old.
      5. Whether a user is at least 16, but under 18 years old.
      6. Whether a user is at least 18 years old.
   3. “Application” means a software application or online service, product, or feature that may be run or directed by a user on a computer, mobile device, or any other general purpose computing device.
   4. “Child” means a person who is under 18 years old.
   5. “Covered application store” means a publicly available website, software application, online service or platform that allows a user to download an application from third-party developers.
   6. “Covered manufacturer” means a person who is a manufacturer of a device, an operating system for a device, or a covered application store.
   7. “Developer” means a person that creates, owns, or controls an application and is responsible for the design, development, maintenance, and distribution of the application.
   8. “Online service, product, or feature” does not mean any of the following:
      1. A broadband internet access service.
      2. A telecommunications service.
      3. The delivery or use of a physical product.
   9. “Signal” means age bracket data or notice of parental consent sent by a real-time secure application programming interface or operating system to an application.
   10. “User” means a child that is the primary user of the device.
2. Requires a manufacturer of a device or an operating system do all of the following:
   1. Provide an accessible interface that requires account holders to indicate the birth date, age, or both, of the user of the particular device for the sole purpose of providing a signal regarding the device user’s age to all applications available in a covered application store.
   2. Provide application developers with a digital signal indicating whether or not a user is in any of the minor age brackets.
   3. If the manufacturer is also an application store:
      1. Obtain parent or guardian consent before permitting a child under 16 to download an application.
      2. Provide a signal in the application store indicating whether a parent or guardian has provided consent.
      3. Provide an option to connect a parent with the application developer for the purpose of managing any parental control tools.
3. Requires an application developer that has actual knowledge of a user’s age to provide any readily available features for account holders to support a user’s use of the application, including the following:
   1. Help manage which accounts are linked to the child user.
   2. Manage the delivery of age appropriate content.
   3. Limit the amount of time that the child user spends daily on an application.
4. Provides that a developer that receives a signal indicating a user’s age shall be deemed to have actual knowledge of the user’s age.
5. Requires a developer to treat a signal indicating a user’s age as the authoritative indicator of a user’s age for purposes of determining the user’s age and for compliance with any state law requiring age verification or parental or guardian consent.
6. Provides that a developer that relies in good faith on a signal indicating a user’s age provided by a covered manufacturer is presumed to have accurately determined the user’s age and be in compliance with any state law that requires age verification or parental guardian consent.
7. Establishes that a person who violates this title shall be subject to an injunction and liable for a civil penalty of not more than $2,500 per child for a negligent violation or not more than $7,500 per child for an intentional violation to be assessed and recovered by a civil action brought by the Attorney General.
8. States that this title does not modify, impair, or supersede the operation of any antitrust law.
9. States that the protections provided by this title are in addition to those provided by any other applicable law, including the California Age-Appropriate Design Code Act.

EXISTING LAW:

1. States that Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. (U.S. Const., amend. I)
2. Establishes the federal Children’s Online Privacy Protection Act (COPPA) to provide protections and regulations regarding the collection of personal information from children under the age of 13. (15 U.S.C. Section 6501 et seq.)
3. Prohibits, under Section 230 of the Communications Decency Act, treating a provider or user of an interactive computer service as the publisher or speaker of any information provided by another information content provider. (47 U.S.C. Section 230(c)(1).)
4. Establishes the California Age-Appropriate Design Code Act, which places a series of obligations and restrictions on businesses that provide online services, products, or features likely to be accessed by children. (Civil Code Section 1798.99.28 et seq.)
5. Under the Protecting Our Kids from Social Media Addiction Act, prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user, except as prescribed. (Health and Safety Code Section 27000 et seq.)

FISCAL EFFECT: As currently in print this bill is keyed fiscal.

COMMENTS: Children today spend more time online than any generation before them—but the internet was not built with them in mind. While minors increasingly rely on digital platforms for education, entertainment, and socialization, they are routinely exposed to harms including exploitative content, manipulative design features, and addictive engagement mechanisms.

Although federal action is ultimately needed to standardize protections across jurisdictions, California’s status as a tech capital and economic giant allows it to lead by example, often setting de facto national standards. The Digital Age Assurance Act (AB 1043) is the latest in a long lineage of California’s efforts to protect its children from online harms. The bill attempts to do this by offering an infrastructure-level solution that avoids direct content regulation while enabling other child protection laws to function effectively.

California has enacted or proposed several laws to better protect minors in digital spaces, but enforcement and implementation remain stymied by a basic infrastructure gap: there is no standardized, privacy-preserving method for determining whether a user is a child. AB 1043, the Digital Age Assurance Act, seeks to fill that gap by establishing a secure signaling framework at the device and app store level. This framework allows developers to receive a tamper-resistant digital signal reflecting a user’s age bracket—without requiring the collection of personal data or documents—and to treat that signal as the authoritative indicator of a user’s age for compliance purposes under California law.

The author explains the impetus behind this measure:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

The Kids Aren’t Alright. The proliferation of digital technologies has significantly transformed the landscape of youth interaction, education, and entertainment. While these advancements offer numerous benefits, they have also introduced a spectrum of risks that disproportionately affect minors.

Exposure to Inappropriate Content. Exposure to inappropriate or harmful content by minors is not a new cultural anxiety, but rather the latest iteration of a long-standing societal concern about the influence of media on youth. From Elvis Presley’s “gyrating hips” in the 1950s to the moral panic over Marilyn Manson’s lyrics in the 1990s, to controversies over Dungeons & Dragons and violent video games like Mortal Kombat and Grand Theft Auto, American culture has long wrestled with moral panics over youth exposure to “inappropriate content.” These episodes—each in their time criticized as corrupting influences—reflect an enduring societal impulse to shield children from potentially harmful media. Yet while history offers no shortage of examples, the proliferation of internet-based platforms and algorithmic targeting has transformed an old concern into an exponentially more potent threat. This is not merely a case of “the same song in a different key”—the scale, speed, and sophistication of digital engagement with minors today is without historical parallel.

Unlike past controversies that were often limited to specific media channels or required parental purchase or access (e.g., buying a CD, renting a video game), today’s minors can access sexually explicit, violent, or otherwise developmentally inappropriate content instantly and anonymously, often through platforms specifically designed to maximize engagement and time-on-site. Online pornography, violent imagery, drug-related content, and pro-eating-disorder forums are widely accessible—often without intentional searching. The rise of deepfake and AI-generated sexually explicit content has only magnified the risk that minors may be targeted, depicted, or desensitized.

Mental Health and Addictive Use Patterns. The prior U.S. Surgeon General has declared youth mental health a national emergency, identifying social media as a significant contributing factor. Adolescents who spend more than three hours per day on social media double their risk of experiencing symptoms of anxiety and depression. (Dr. Vivek Murthy, “Surgeon General: Why I’m Calling for a Warning Label on Social Media Platforms” New York Times (Jun. 17, 2024), https://www.nytimes.com/2024/06/17/opinion/social-media-health-warning.html.) Despite these risks, the average adolescent use exceeds 4.5 hours daily. ​(Id.) Design features such as push notifications, auto-play, infinite scroll, and algorithmic engagement loops have been shown to foster excessive use, trigger addiction-like responses in adolescents, and disrupt sleep cycles. (Id. Burhan & Moradzadeh, “Neurotransmitter Dopamine and its Role in the Development of Social Media Addiction” 11 Journal of Neurology & Neurophysiology 507 (2020), https://www.iomcworld.org/open-access/neurotransmitter-dopamine-da-and-its-role-in-the-development-of-social-mediaaddiction.pdf.) ​

Internal research from social media companies corroborates these findings. Meta’s own documents indicate that Instagram use worsens body image issues for one in three teen girls, with a disturbing subset of teens attributing suicidal thoughts to their social media use. Teens report feeling worse about themselves due to social comparison—a phenomenon that is often amplified through platform design​. (Alex Hern, ‘Never get high on your own supply’ – why social media bosses don’t use social media,” The Guardian (Jan. 23, 2018), https://www.theguardian.com/media/2018/jan/23/never-get-high-on-your-own-supply-why-social-media-bosses-dont-use-social-media.)

Bullying and Harassment. According to the Surgeon General’s advisory, and corroborating internal platform data, approximately two-thirds of adolescents frequently encounter hate-based or harassing content. Nearly 75% of youth report that platforms perform poorly at preventing online bullying​. (Alhajji et al., “Cyberbullying, Mental Health, and Violence in Adolescents and Associations With Sex and Race: Data From the 2015 Youth Risk Behavior Survey” Global pediatric health (2019), https://journals.sagepub.com/doi/10.1177/2333794X19868887; Vogels, “Teens and Cyberbullying,” Pew Research Center: Internet, Science & Tech (2022), https://www.pewresearch.org/internet/2022/12/15/teens-and-cyberbullying-2022/.) Girls and LGBTQ+ youth are disproportionately affected, with rates of online sexual harassment particularly high among adolescent girls. Platform policies and moderation practices often fail to prevent repeat exposure to harmful content, while lax privacy settings facilitate unwanted contact from adult strangers​.

Signals and their Reliability as Age-Indicators. A “signal” is a real-time, privacy-preserving digital transmission sent by a device’s operating system or application store (collectively referred to as covered manufacturers) to developers of applications. The signal conveys the user’s age bracket—such as under 5, 5–9, 10–12, 13–15, 16–17, or 18 and over—based on birthdate or age information entered by the device owner, typically a parent or guardian, at the time the device is set up. In some instances, the signal may also indicate that verifiable parental or guardian consent has been obtained, such as when a child under 16 downloads an application.

The bill requires covered manufacturers to provide an accessible user interface to collect age or birthdate data during device onboarding. From that information, the system derives a nonpersonally identifiable age bracket and transmits it via a secure, tamper-resistant API to applications operating on the device. This allows developers to apply appropriate age-based policies or protections in compliance with laws that require age verification or parental consent.

Although the age input may not be verified through biometric scans or identity documents, the signal is designed to reflect good-faith entries by a parent or guardian and, importantly, cannot later be modified by the user. Minors are therefore unable to change their signal or input false information later in an attempt to bypass parental controls or age-based restrictions. Likewise, developers and applications cannot spoof or overwrite the signal. This infrastructure is intentionally designed to be both privacy-preserving and resistant to circumvention.

In sum, the signal serves as a standardized, constitutionally cautious, and privacy-protective mechanism to support consistent age-based treatment across applications. It is not a foolproof biometric verification tool, but it avoids the legal and practical pitfalls of invasive data collection or individualized surveillance. As the author contends, the alternatives—such as requiring facial scans, government ID uploads, or continuous monitoring—would present far greater risks to privacy, scalability, and equity.

This Bill - Obligations for Covered Manufacturers. The bill assigns implementation responsibilities to certain technology platform operators—defined as “covered manufacturers”—which includes device manufacturers, operating system providers, and application stores. Covered manufacturers must provide an interface that prompts device owners to designate the birth date or age of the device user. This age data is then converted into a nonpersonally identifiable “signal” indicating the user’s age bracket (e.g., under 5; 5–9; 10–12; 13–15; 16–17; 18+), which must be made available in real-time to developers through a secure application programming interface (API).

For covered application stores (a subset of “covered manufacturers”), the bill imposes additional obligations: before allowing the download of any application by a user under the age of 16, the store must first obtain verifiable parental or guardian consent and pass a signal to the developer indicating that such consent has been obtained. Application stores must also provide an option to connect parents with developers for the purpose of enabling or managing any available parental tools.

This Bill - Obligations for Developers. Once a developer receives a signal under AB 1043 indicating the age bracket of a user—or that verifiable parental consent has been provided for a user under 16—the signal triggers specific legal and operational consequences, depending on the developer’s application and any other laws that apply. The signal does not by itself compel any specific change in how content is offered, ads are served, or feeds are structured, but it enables developers to make age-appropriate adjustments and comply with other laws that may require such adjustments. In short: the signal enables—but does not compel—content, advertising, and feature changes based on the age of the user. It functions as a trusted infrastructure layer for complying with more prescriptive laws.

Developers who receive a signal indicating that a user is under 18 are deemed to have actual knowledge that the user is a child. Developers with such knowledge are required to:

1. Activate any available parental tools appropriate to the risks of the application, including:
   • Managing linked accounts.
   • Delivering age-appropriate content.
   • Limiting daily screen time.
2. Treat the signal as the authoritative source for purposes of any state law requiring age verification or parental consent.
3. Benefit from a presumption of compliance: If a developer reasonably relies on a signal from a covered manufacturer in good faith, they are presumed to have satisfied any relevant age-verification or parental-consent obligations under California law.

Importantly, developer obligations under the bill only apply when parental control tools are already built into the application—the bill does not require developers to create new features that do not otherwise exist. While the language attempts to clarify this by referring to “any readily available features,” the phrasing may still be interpreted as implying an obligation to develop or expand such tools.

As noted in the Assembly Privacy and Consumer Protection Committee’s analysis, the author may wish to revisit and refine certain definitions to appropriately narrow the bill’s scope. For instance, the term “covered manufacturer” includes any person who is a manufacturer of a “device,” but the term “device” is not defined. Without a limiting definition, this could unintentionally extend the bill’s application to a wide range of internet-connected appliances, from smartphones to smart dishwashers.

Authoritative Indicator and Presumption of Accuracy. AB 1043 establishes that the age bracket signal provided by a covered manufacturer—such as a device operating system or application store—serves as the authoritative indicator of a user’s age for the purpose of complying with any California law requiring age verification or parental or guardian consent. In other words, developers are expected to treat the signal as dispositive of a user’s age unless they possess credible evidence to the contrary.

This structure is essential to the bill’s legal and practical function. Rather than require developers to implement their own independent age estimation or verification processes—which could raise privacy, cost, and legal risks—AB 1043 enables developers to rely on a single, secure, and standardized signal provided by upstream actors (i.e., covered manufacturers) who collect age information during the device setup process. This division of responsibility is meant to improve interoperability, scalability, and compliance consistency.

Importantly, the bill creates a rebuttable presumption that a developer who relies in good faith on the signal “has accurately determined the user’s age and is in compliance with any state law that requires age verification or parental guardian consent.” This presumption serves two key functions:

1. It shields developers from liability under child-protective statutes—such as SB 976 (2024), which requires verifiable parental consent before serving addictive algorithmic feeds to minors—so long as they reasonably rely on the signal.
2. It establishes clarity and uniformity in enforcement by ensuring that a single, device-originated signal will be sufficient to establish compliance unless the developer has “actual knowledge” that the user is not within the age bracket indicated.

The presumption is rebuttable, meaning that if a developer possesses actual knowledge that the signal is inaccurate—whether through contradictory user disclosures, behavioral indicators, or account data—they may no longer rely on it and must treat the user accordingly. However, the bill explicitly provides that receipt of the signal alone is sufficient to create actual knowledge that the user is a child, for purposes of triggering any duties to enable any readily available parental tools.

By assigning the signal authoritative status, AB 1043 eliminates the ambiguity developers often face in determining whether a user is a minor, without requiring invasive or burdensome verification techniques. The framework is thus designed to maximize privacy, minimize compliance burdens, and reduce liability exposure, while still preserving accountability in cases where a developer willfully ignores contradictory evidence.

Constitutional Strategy. AB 1043 is structured to avoid the constitutional vulnerabilities that led to preliminary injunctions against prior legislative efforts—including AB 2273 (Wicks, 2022) and SB 976 (Skinner, 2024)—and is designed to be consistent with recent First Amendment jurisprudence, including the U.S. Supreme Court’s decision in Moody v. NetChoice, (2024) 603 U.S. 707. In NetChoice v. Bonta, both the district and appellate courts enjoined AB 2273 on the grounds that its requirements—such as compelled age estimation, data protection impact assessments (DPIAs), and design justifications—constituted content-based regulations of protected speech, and failed strict scrutiny. Similarly, in litigation challenging SB 976, the district court enjoined portions of the law that imposed compelled disclosure requirements (specifically the annual public reporting mandate), finding that these too were content-based regulations that burdened the editorial and operational discretion of platforms without sufficient tailoring. Learning from these rulings, AB 1043 intentionally avoids four key constitutional pitfalls:

No content-based regulation: The bill does not regulate, restrict, or compel how developers display or curate content. It does not require developers to alter or moderate the content offered to users based on age, nor does it restrict access to lawful speech. This avoids triggering the heightened scrutiny typically applied to content-based speech regulations under Reed v. Town of Gilbert (2015) 576 U.S. 155 and its progeny.

No design mandates: Unlike AB 2273 or certain provisions of SB 976, AB 1043 does not require businesses to redesign their platforms, interfaces, or algorithmic systems. It does not require developers to alter how features are presented or how user interaction is structured. This preserves the editorial and functional autonomy of developers, in line with holdings in Moody and NetChoice v. Paxton (5th Cir. 2022) 49 F.4th 439, both of which recognized that design decisions implicate expressive rights.

No compelled speech or disclosure requirements: The bill does not require developers to make public statements, submit DPIAs, publish user statistics, or explain their business practices to regulators. It steers clear of the compelled speech doctrine outlined in cases like National Institute of Family and Life Advocates v. Becerra (2018) 585 U.S. 755, which held that governments may not force private actors to make disclosures unrelated to their own speech or to controversial topics.

No access restrictions or penalties: AB 1043 does not require developers to deny access to users who do not generate a signal, nor does it condition the availability of services on receipt of a signal. It also does not impose penalties for failing to use a signal. Rather, the bill merely establishes a legal presumption and authorizes developers to rely on the signal if they choose to—making it a facilitative tool, not a regulatory mandate.

Instead of regulating speech or product design, AB 1043 builds neutral infrastructure to support compliance with other California laws—such as SB 976—or future legislation that may impose content- or design-based requirements on age-related access. It does so by offering a standardized, interoperable, and privacy-preserving mechanism for age signaling that developers may use voluntarily, and which may also function as a shield against liability when laws require age verification or parental consent. Finally, the bill’s architecture is consistent with the Supreme Court’s reasoning in Moody v. NetChoice, which reaffirmed that platform-level curation and ranking of user content are expressive activities protected by the First Amendment. AB 1043 neither interferes with these expressive functions nor requires developers to carry or suppress any particular viewpoint. It instead provides factual, non-expressive signals (i.e., age brackets) that developers may incorporate into their existing compliance tools or ignore—thereby staying safely within the bounds of constitutionally permissible regulation.

Enforcement. The current enforcement provision in AB 1043 authorizes civil penalties for any violation of the title but does not explicitly define what constitutes a violation by a covered manufacturer versus a developer. To improve clarity, reduce litigation risk, and ensure fair notice to regulated entities, the author may wish to consider amending the bill to specify, in more detail, the types of conduct that would constitute an enforceable violation for each category of actor.

Opposition. In its April 21, 2025 opposition letter, Google raises several concerns with AB 1043, primarily focused on the scope, implementation, and privacy implications of the bill’s age signaling framework. First, Google argues that the bill shifts too much responsibility to application stores and shields developers from liability by allowing them to rely on a signal that a user is 18 or older. This, they suggest, may encourage the development of more invasive identity verification methods in order to avoid liability. In response, it is important to clarify that AB 1043 does not immunize developers from legal obligations. To the contrary, developers who receive a signal indicating a user is under 18 are deemed to have actual knowledge of that user’s age and must activate any readily available parental tools accordingly. Developers remain liable under child protection statutes if they have actual knowledge contradicting the signal.

Second, Google contends that transmitting age bracket signals broadly to developers poses privacy risks, especially if the signal could be misused by bad actors. While this concern highlights a legitimate implementation challenge, AB 1043 limits the signal to nonpersonally identifiable age bracket data transmitted via a secure, tamper-resistant API.

Third, Google also raises concerns that the bill does not impose affirmative duties on developers to take protective action even when they receive a signal, thereby undermining its effectiveness. But AB 1043 is designed as an infrastructure bill—it facilitates, but does not compel, content or feature changes. The developer’s duty to act is limited to enabling existing parental tools when they have actual knowledge of a user’s age, in order to avoid First Amendment concerns that have enjoined prior California laws. Any effort to impose content mandates would face constitutional challenges.

Finally, Google contends that AB 1043 limits flexibility for parents to manage app access, suggesting that it may interfere with platform-level features allowing parents to customize or batch-approve downloads. However, AB 1043 is silent on the design of parental tools and does not prevent platforms from building more sophisticated or granular control systems.

Overall, while some of Google’s concerns reflect implementation challenges, many stem from a misunderstanding of the bill’s scope. AB 1043 is not a mandate to redesign content, restrict speech, or impose new parental control obligations—it is a standardized, privacy-preserving infrastructure that enables compliance with other child safety laws. Minor clarifying amendments may address stakeholder concerns without undermining the bill’s purpose.

Additional concerns raised by opposition are discussed below.

ARGUMENTS IN SUPPORT: AAPI Equity Alliance supports this measure, especially for its potentially positive impact on its community:

The Digital Age Assurance Act provides a thoughtful solution that creates consistent protections for all children. By implementing age verification at the app store level rather than requiring individual platforms to develop their own systems, this legislation creates a more streamlined, accessible approach for families in our communities. Parents can provide consent for their children's app downloads through a single, consistent interface, eliminating the confusion of navigating different processes across multiple platforms.

This approach is particularly beneficial for parents with limited English proficiency or limited technical knowledge, who often struggle to understand and implement safety controls across numerous apps and platforms. The simplified system helps bridge digital divides that disproportionately affect immigrant communities, including many AAPI families.

The Source LGBT+ Center also expresses support for this bill, recognizing the critical importance of balancing online safety with access to life-affirming digital spaces:

AB 1043 takes a fundamentally different approach. By focusing on age verification at the app store level rather than forcing individual platforms to implement their own systems, this legislation protects children without creating unnecessary barriers to accessing important resources.

This preserves critical access to LGBTQ+ community support that many young people desperately need. It maintains youth access to accurate information about gender and sexuality without stigmatizing content filters. The bill protects against future attempts to censor LGBTQ+ content under the guise of child protection, while allowing teens to safely explore their identity with appropriate protections in place. Crucially, it ensures continued access to mental health resources that save lives.

Importantly, AB 1043 gives parents appropriate tools without creating systems that could be weaponized against vulnerable youth. The bill's age-bracket system provides necessary protections without requiring extensive personal data collection that could compromise privacy.

ARGUMENTS IN OPPOSITION: The Chamber of Progress, a tech industry association supporting public policies to build a more inclusive society in which all people benefit from technological advancements, support the efforts to strengthen protections for minors online, but oppose this bill, arguing, among other things, that AB 1043 threatens innovation:

Through its rigid, prescriptive requirements on device manufacturers and app stores, AB 1043 risks chilling innovation. Covered manufacturers would be forced to redirect their resources toward meeting strict and ineffective compliance mandates rather than continuing to focus on developing the tools to improve child safety online, delaying or preventing the rollout of new safety features. Innovators seeking to build new services tailored appropriately for youth, including educational platforms, mental health resources, and safe social spaces, would face higher barriers that, ironically, make it harder for companies to deploy the very protections the bill seeks to promote in a timely manner.

Oakland Privacy also opposes this measure:

[AB 1043’s mandates impose]… an extraordinary amount of complex programming for the huge universe of free and low-cost applications available through the Google Play and Apple stores. It seems obvious that it would a) cause phone applications to be much larger and therefore greatly reduce the number of applications any user could load onto their phone and b) inevitably will result in far fewer free apps for users as costs will significantly rise for creating and maintaining apps. In addition, there is an entire universe of phone apps for which the demands to decode multiple signals, get adult consent and manage content are irrelevant, including functional apps like calendars and to-do lists, simple games, store apps, authenticator and security apps, router control apps and remote controls, keyboard apps, clocks, ride share apps, maps and directions, news and local information, transit schedules, music streaming apps, digital wallets, scheduling apps and the like that have no discernible harmful impacts on minors, but would have to implement this entire scheme under the bill.

We also want to be realistic about teenagers, especially those 14 and older. As with other well-intentioned adult interventions, like say ID’s to get into bars and clubs, it is famously not that difficult to evade such efforts. Fake ID’s are a cottage industry 4 and similarly we can envision here a world of “parent-phones” and “free phones” where a large industry would develop around inexpensive adult-coded cheap burner phones with pay as you go cards to avoid the entire parental monitoring scheme. Such natural teenage rebellion to the idea of parents limiting them to “age-appropriate content” and an hour a day on their favorite apps, including texting their friends, can have the inadvertent effect of pushing young people into less safe spaces than the mainstream Internet including increasingly dodgier devices, apps and app stores.

It is important to note for the record that there is no objective standard in the bill for what constitutes risks to minors and not only does that vary greatly from a five year old to a 17 year old, it also varies greatly from one adult perspective to another.

It seems like these decisions would be made by two entities: a) app developers who would provide some kind of censoring controls and b) parents who would operate those controls. In both cases, the vague term “age-appropriate content” could mean many different things. We have seen - and this is not completely absent in the state of California - efforts to ban books from school libraries because they contain gay characters or make references to racism in society or even because they refer to sexual activity. Do we really want a version of Good Reads that censors Judy Blume’s Forever or Are You There God, It’s Me Margaret, books literally written to help young girls make sense out of puberty? Let’s not forget that although we happily play Jailhouse Rock at 10 year old slumber parties nowadays, at the time some parents wanted the song banned because Presley provoked “lewd feelings” in teenage girls. Age-appropriate is at best a highly subjective term.

REGISTERED SUPPORT / OPPOSITION:

Support

Children Now (co-sponsor)

International Centre for Missing & Exploited Children (co-sponsor)

AAPI Equity Alliance

California Parents for Public Virtual Education

Parents for School Options

Parents Support for Online Learning

Protect Our Kids

The Source LGBT+ Center

The Translatin@ Coalition

Support if Amended

Internet.works

Opposition

Chamber of Progress

Google

Oakland Privacy

TechNet-Technology Network

Analysis Prepared by: Shiran Zohar / JUD. / (916) 319-2334

Date of Hearing: April 22, 2025

Fiscal:

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Rebecca Bauer-Kahan, Chair

ABPCA Bill Id:AB 1043 (

Author:Wicks) – As Amended Ver:March 28, 2025

SUBJECT: Age verification signals: software applications and online services

SYNOPSIS

Over the last decade, the Legislature has worked to protect children from the potential harms they face on the largely unregulated internet. It would be unthinkable to most parents to leave their children alone in a public place to fend for themselves. However, when children spend time on the internet, they are often left unsupervised. The risks are significant. On platforms designed to optimize engagement, children can be subjected to cyberbullying, scammed, exposed to violent pornography, groomed in chat rooms, fed algorithmically-driven inappropriate content, and may develop unhealthy relationships with strangers and AI companions.

This bill, sponsored by the International Centre for Missing and Exploited Children and Children Now, seeks to require device and operating systems manufacturers to develop an age assurance signal that will be sent to application developers informing them of the age-bracket of the user who is downloading their application or entering their website. Depending on the age range of the user, a parent or guardian will have to consent prior to the user being allowed access to the platform. The bill presents a potentially elegant solution to a vexing problem underpinning many efforts to protect children online. However, there are several details to be worked out on the bill to ensure technical feasibility and that it strikes the appropriate balance between parental control and the autonomy of children, particularly older teens.

The bill is supported by several parents’ organizations, including Parents for School Options, Protect our Kids, and Parents Support for Online Learning. In addition, the TransLatin Coalition and The Source LGBT+ Center are in support. The bill is opposed by Oakland Privacy, TechNet, and Chamber of Progress.

If passed by this Committee, the bill will next be heard by the Judiciary Committee.

THIS BILL:

1. Requires a manufacturer of a device or an operating system do all of the following:
   1. Provide an accessible interface that requires device owners to indicate the birth date, age, or both, of the user of the particular device.
      1. Limits the use of the data to providing a signal regarding the device user’s age to all applications available in a covered application store.
   2. If the manufacturer is also an application store:
      1. Obtain parent or guardian consent before permitting a child under 16 to download an application.
      2. Provide a signal in the application store indicating whether a parent or guardian has provided consent.
      3. Provide an option to connect a parent with the application developer for the purpose of managing any parental control tools.
   3. Provide application developers with a digital signal signaling whether or not a user is in any of the age brackets.
2. Requires an application developer that has actual knowledge that a user is under 18 via a signal regarding the users age, to the extent technically feasible, provide readily available features for parents to support a child users use of the application.
3. Requires an application developer to provide parents features that do all of the following, as appropriate given the risks that arise from the use of the application:
   1. Help manage which accounts are linked to the child user.
   2. Manage the delivery of age appropriate content.
   3. Limit the amount of time that the child user spends daily on an application.
4. States that a signal is presumed to be accurate and that a developer may rely on the signal for the purpose of compliance with any state law that requires age verification or parental consent.
5. Defines the following:
   1. “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age that indicates only the following:
      1. Whether a user is under five years old.
      2. Whether a user is at least five, but under 10 years old.
      3. Whether a user is at least 10, but under 13 years old.
      4. Whether a user is at least 13, but under 16 years old.
      5. Whether a user is at least 16, but under 18 years old.
      6. Whether a user is at least 18 years old.
   2. “Application” means a software application or online service, product, or feature that may be run or directed by a user on a computer, mobile device, or any other general purpose computing device.
   3. “Child” means a person who is under 18 years old.
   4. “Covered application store” means a publicly available website, software application, online service or platform that allows a user to download an application from third-party developers.
   5. “Covered manufacturer” means a person who is a manufacturer of a device, an operating system for a device, or a covered application store.
   6. “Developer” means a person that creates, owns, or controls an application and is responsible for the design, development, maintenance, and distribution of the application.
   7. “Online service, product, or feature” does not mean any of the following:
      1. A broadband internet access service.
      2. A telecommunications service.
      3. The delivery or use of a physical product.
   8. “Signal” means age bracket data or notice of parental consent sent by a real-time secure application programming interface or operating system to an application.
   9. Establishes that a person who violates this title shall be subject to an injunction and liable for a civil penalty of not more than $2,500 per child for a negligent violation or not more than $7,500 per child for an intentional violation.
   10. The penalty will be assessed and recovered by a civil action brought by the Attorney General.
   11. States that this title does not modify, impair, or supersede the operation of any antitrust law.
   12. States that the protections provided by this title are in addition to those provided by any other applicable law, including the California Age-Appropriate Design Code Act.

EXISTING LAW:

1. States that Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. (U.S. Const., amend. I)
2. Establishes the federal Children’s Online Privacy Protection Act (COPPA) to provide protections and regulations regarding the collection of personal information from children under the age of 13. (15 U.S.C. § 6501 et seq.)
3. Prohibits, under Section 230 of the Communications Decency Act, treating a provider or user of an interactive computer service as the publisher or speaker of any information provided by another information content provider. (47 U.S.C. § 230(c)(1).)
4. Establishes the California Age-Appropriate Design Code Act, which places a series of obligations and restrictions on businesses that provide online services, products, or features likely to be accessed by children. (Civ. Code § 1798.99.28 et seq.)
5. Under the Protecting Our Kids from Social Media Addiction Act, prohibits an operator of an addictive internet-based service or application, including a social media platform, from providing an addictive feed, as defined, to a minor user, except as prescribed. (Health & Saf. Code § 27000 et seq.)

COMMENTS:

1) Author’s statement. According to the author:

California’s children are growing up with access to an online world that was not built with them in mind. Kids rely on the digital world for education, entertainment, and socialization, but there are no guardrails that protect them from exposure to manipulative design features, and inappropriate interactions. This leaves children vulnerable to harm, including cyberbullying, sextortion, mental health struggles and more. This is simply unacceptable. It is essential that online spaces are designed with children’s safety in mind from the outset — and a key part of that design is the ability to accurately assess a user’s age.

The Digital Age Assurance Act is a crucial step in ensuring kids can explore the digital world more safely — and a critical step needed for us to require social media and other online companies to implement higher consumer safety standards for products accessed by kids. The urgency behind AB 1043 is backed by mounting evidence of the harmful impacts unregulated digital environments can have on children’s mental health, safety, and overall well-being. Creating a statutory age assurance framework that balances privacy and usability will give parents greater peace of mind, build trust with children and families, and create consistency for businesses looking to innovate responsibly. AB 1043 provides a scalable path forward — one that encourages the development of safer online experiences while preserving the benefits of digital participation for young users.

2) Age verification. Policymakers around the world have struggled in recent years to determine the best method for verifying the ages of internet users without eroding people’s fundamental privacy rights. Among the most common ways of verifying age are requiring users to upload their government issued identification to prove their age or by allowing users to self-attest to their age.

Last year alone, this committee heard several bills related to protecting children’s personal information, activities online, and attempting to tackle questions related to age verification. Among them:

• AB 1949 (Wicks), sponsored by Attorney General Rob Bonta, would have amended the California Consumer Privacy Act (CCPA) to prohibit businesses from collecting the personal information of a consumer under 18 years of age unless the consumer, or the consumer's parent or guardian if under 13, affirmatively authorizes the collection. That bill was vetoed by the Governor.
• AB 3080 (Alanis and Hoover) would have required online businesses that provide products that are illegal for children to access, take reasonable steps to ensure the user is of legal age at the time of access, including, but not limited to, verifying the age of the user. Of particular concern for these authors was children’s access to online pornography. That bill was held on the Senate Appropriations Committee’s suspense file.
• SB 976 (Skinner; Stats. 2024, Ch. 321) established the Protecting our Kids from Social Media Addiction Act. The act prohibits social media companies from providing minors, without parental consent, addictive feeds, and from sending minors notifications during certain timeframes.

In commenting on last year’s AB 3080 (Alanis), the Age Verification Providers Association, wrote about “the ease of use of the wide variety of methods of age verification, and the data minimization designed into these approaches so personally identifiable data need never be retained.” They stated that “reasonable age verification methods” include:

Remote electronic identification verification technology (eIDVT) – government issued physical identity documents such as passports or driving licenses are scanned as an image using the user’s mobile phone camera or webcam, or, in some cases where this is included, a computer chip in the document can be read by a smartphone. The user is asked to provide a live selfie image which can then be electronically compared to the image from the ID, and provided the two match, then the age information is recorded and can then be used as the basis of age verification.

[…]

Online banking integration – Some AV providers have reached agreement with banks to allow a customer to log into their online banking and give consent for the bank to confirm their date of birth to the AV provider.

Credit Reports and other transactional databases – A user can give consent for an AV provider to check with Credit Report bureau if the age they are claiming is accurate. Typically, the user will have to give some further reassurance that they are the person whose credit report they are claiming belongs to them; for example, knowing about some recent payments they have made. Other authoritative databases can play a similar role, with their own approaches to authentication of the user claiming the age data relates to them.

Facial age estimation – through machine learning, algorithms can now predict to within 1 ½ years mean average error the age of a user from a selfie image. The National Institute of Standards and Technology (NIST) have been testing competing solutions from providers and are expected to publish their findings this week, prior to the Committee’s hearing. While some people have expressed concerns about adults sharing a selfie image for this purposes, it should be noted that the estimation can be made locally on the user’s own phone or PC, so the image need never be shared with a third party. Given there is a margin for error, typically this would be made available as an option for users who are several years over 18 – for example, 23 – when it is statistically proven that the vast majority of minors under 18 would not be estimated to look at least 23. Users who are closer to 18 will need to use an alternative mechanism.

[…]

Reusable digital identity – Digital ID is becoming increasingly available. Several US states issue mobile drivers licenses, for example. Users can give consent for the age to be selectively shared with AV providers, typically using an approach called Verifiable Credentials.

Commenting on the same earlier bill, the Free Speech Coalition, which advocates for the adult film industry, suggested in content-filters installed on personal computers:

Filters are already available on phones, tablets, laptops and home WiFi networks. They are easy to set up and, for the most part, free to use. . . .

Filters [cannot] be evaded by use of VPN — the virtual private networks that allow users to evade the regulations by accessing the internet through another state or country. Filters can be tailored to remove sites like Twitter and Reddit which allow adult content. . . . Filters can also trigger “safe search” settings on search engines, which prevent adult content or sites from appearing in search results.

A 2022 report by France’s National Commission on Informatics and Liberty (CNIL) “analysed the main types of age verification systems in order to clarify its position on age verification on the Internet, particularly on pornographic sites for which such verification is mandatory. It specifies how such publishers could fulfil their legal obligations. However, CNIL finds that such current systems are circumventable and intrusive, and calls for the implementation of more privacy-friendly models.”^[1] A Verge article describing this report states: “CNIL notes that identifying someone’s age with a credit card would be relatively easy since the security infrastructure is already there for online payments. But some adult users — especially those with lower incomes — may not have a card, which would seriously limit their ability to access online services. The same goes for verification methods using government-issued IDs. Children can also snap up a card that’s lying around the house to verify their age.” ^[2]

3) Potentially harmful experiences on the internet. The early 2010s saw a major upsurge in adolescent depression and anxiety, self-harm, and suicide. The trend is concentrated in Gen Z, and girls are more impacted than boys.^[3] As of 2021, relative rates of depression teen girls and boys had increased by roughly 150% compared to 2010.^[4] The trend is reflected in objective measures, including hospitalizations from self-harm. In 2020, young teenage girls were hospitalized for self-harm, primarily from cutting, at three times the rate they were in 2010.^[5] Young teen suicide more than doubled in this timeframe.^[6] Similar trends have been observed in several western countries.^[7] These trends track “the years when adolescents in rich countries traded their flip phones for smartphones and moved much more of their social lives online . . .”^[8] Some specific types of harmful online experiences follow:

Social media. In May 2023, former Surgeon General Vivek Murthy issued an advisory warning of the potential mental health impacts of social media on young people. The advisory recognizes the benefits of social media for some users but concludes “the current body of evidence indicates that while social media may have benefits for some children and adolescents, there are ample indicators that social media can also have a profound risk of harm to the mental health and well-being of children and adolescents.”^[9] While noting that several complex factors shape social media’s influence on children and adolescents, the Surgeon General points to two primary risk factors: 1) harmful content, and 2) excessive and problematic use. Harmful content includes:

• Extreme content such as live depictions of self-harm acts, like asphyxiation or cutting, “which can normalize such behaviors, including through the formation of suicide pacts and posing of self-harm models for others to follow.”^[10]
• Bullying and harassment: roughly two-thirds of adolescents are “often” or “sometimes” exposed to hate-based content, with nearly 75% adolescents stating that social media sites do a fair to poor job of addressing online harassment and bullying.^[11]
• Predatory behaviors, including financial or sexual exploitation of children and adolescents; nearly 6-in-10 adolescent girls surveyed had received unwanted advances from strangers on social media platforms.^[12]

The advisory also cites studies showing that on a typical weekday, nearly one in three adolescents report using screens – most commonly, social media – until midnight or later.^[13] One third or more of girls aged 11-15 feel “addicted” to certain platforms. Excessive use correlates with attention problems, feelings of exclusion, and sleep problems.^[14] Poor sleep, in turn, is linked with neurological development issues, depression, and suicidality.^[15] These findings are borne out by the observations of platforms themselves: internal Meta research detailed in a recent lawsuit concluded that “when social media use displaces sleep in adolescents, it is negatively correlated to indicators of mental health.”^[16] As of 2024, the average daily social media usage for US adolescents was 4.8 hours.^[17]

Children’s exposure to violent pornography. The widespread availability of violent pornography has reshaped the sexual expectations of young men and women, often in ways that are harmful to intimacy, consent, and mutual pleasure. Among the impacts are:

• Young men report that in consuming pornography they become desensitized and require more intense material to achieve the same level of arousal. This can result in young men developing unrealistic and aggressive sexual expectations that do not align with mutual respect and consent in real-life relationships.
• Violent pornography often portrays men as dominant aggressors and women as submissive participants who enjoy acts of humiliation and pain. This can distort young men’s understanding of sexual dynamics, making coercion and violence appear normal or even desirable.
• Heavy pornography use has been linked to lower relationship satisfaction and difficulty maintaining emotional connections. Young men who rely on porn for sexual gratification may struggle with real-life intimacy, viewing partners as objects for gratification rather than equals in a mutual experience.^[18]

Young women, as well, have been impacted by violent pornography becoming mainstream:

• As violent pornography becomes more mainstream, young women often feel pressured to engage in degrading or painful sexual acts—such as choking, slapping, or rough anal sex—even if they are uncomfortable with them.
• Exposure to violent pornography can distort young women’s perceptions of consent, making them believe that discomfort and pain are expected parts of sex. Many report feeling unsure of how to set boundaries, fearing rejection or disappointment from male partners who have been conditioned by pornographic scripts.
• Women in pornography are often portrayed as passive objects meant to satisfy male pleasure. This can lead to additional body image issues and lower self-esteem in young women, who may feel additional pressure to conform to unrealistic beauty standards and sexual performance expectations.^[19]

Young boys’ exposure to the manosphere. The manosphere is a broad term that refers to a wide variety of men’s groups operating on the internet. Generally, the term is used to specifically describe interconnected misogynistic communities. The rise of these groups tracks a disturbing downturn in the wellbeing among young men. Many men and boys are drawn into these spaces when they are in search of solutions to their problems, whether it is social isolation or negative experiences with women, only to be radicalized over time by increasingly extreme content.

Deepfake Pornography. Since its inception, generative artificial intelligence (GenAI) has been used to create nonconsensual pornography, more accurately referred to by sexual assault experts as image-based sexual abuse—almost entirely against women and girls. The widespread availability of GenAI has led to a proliferation of websites and phone-based apps that offer user-friendly interfaces for uploading clothed images of real people to generate photorealistic nude images of not only adults, but also children. According to a recent New York Times article:

Boys in several states have used widely available “nudification” apps to pervert real, identifiable photos of their clothed female classmates, shown attending events like school proms, into graphic, convincing-looking images of the girls with exposed A.I.-generated breasts and genitalia. In some cases, boys shared the faked images in the school lunchroom, on the school bus or through group chats on platforms like Snapchat and Instagram, according to school and police reports.^[20]

In February 2024, deepfake nude images of 16 eighth-grade students were circulated among students at a California middle school.^[21] Similar reports of abuses, almost always against girls, have been reported across the country and show no sign of abating.^[22]

AI Companions. Roughly half of teens report using chatbots, with 24% using them at least weekly and 11% daily.^[23] According a recent report from the Minnesota Attorney General, the widespread use of chatbots by teens “has not been accompanied by corresponding safeguards.” These products can be “‘extremely addictive’” and “researchers have documented that over-usage and addiction are primary risks of personalized chatbots. Several studies have shown that aggregate positive benefits of chatbots are possible, but investigations by journalists and clinicians suggest that these products are not robust in terms of the quality and safety of their responses.”^[24]

4) What this bill would do. The primary purpose of this bill is to protect children from the real harms listed above. According to the author, the status quo of asking businesses to assess children’s ages without meaningful accountability is not working for youth. By establishing an age assurance framework in statue, California can protect children while respecting adult access to the internet. In establishing the framework, the current version of the bill requires that manufacturers and application developers do the following for the parents of child device users under 18:

Age assurance signal. Manufacturers of computer devices and operating systems are required to develop an accessible methods for parents to indicate the age and/or birthdate of the primary users of a devices. Once the manufacturer is aware of the age of the user, the device or the operating system must inform an app developer of the age bracket of the user attempting to download their application, using a signal.

Age brackets. If the manufacturer also maintains an online application store, as Apple and Google both do, it would send developers a signal indicating whether the user falls into one of the following age brackets:

• • Under five years old
  • Five to nine
  • 10 to 12
  • 13 to 15
  • 16 to 17
  • Over 18 years old

Parental controls. The bill requires manufacturers to provide parents and guardians the ability to:

• Consent prior to allowing a user under 16 to download an application to their device.
• Connect with the app developer so that the parent may access any parental controls within the application.

A developer who receives a signal indicating that a user is a child, if technically feasible, must provide parents with parental control features. In addition, “as appropriate given the risks that arise from the use of the application” those features must do the following:

• Manage which accounts are linked to their children.
• Manage the delivery of age-appropriate content.
• Limit the amount of time their children spend daily on the application.

Applications covered under the bill. The current definition in the bill covers software applications, online services, products, or features that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device. This would include, for example, any website the user want to visit, computer program, game, photo editor, and all applications available in an app store.

Enforcement. The bill includes enforcement by the Attorney General and includes an injunction and civil penalties between $2,500 and $7,500 for each impacted child for each violation.

5) Opposition concerns. Opponents of the bill raise concerns about the requirement that every application, regardless of how harmless and benign, would be required to develop a way to receive complex signals regarding the age bracket of device users and then create parental controls that the owner of a separate device uses to not only control the downloading of the application but also limit the content and the time the child spends on each application. Regarding this process, Oakland Privacy writes:

This is an extraordinary amount of complex programming for the huge universe of free and low-cost applications available through the Google Play and Apple stores. It seems obvious that it would a) cause phone applications to be much larger and therefore greatly reduce the number of applications any user could load onto their phone and b) inevitably will result in far fewer free apps for users as costs will significantly rise for creating and maintaining apps. In addition, there is an entire universe of phone apps for which the demands to decode multiple signals, get adult consent and manage content are irrelevant. . . . [Including applications that] have no discernible harmful impacts on minors, but would have to implement this entire scheme under the bill.

Along with the potential technical difficulties associated with the current version of the bill, opponents also raise concerns about language in the bill the leaves developers and parents responsible for determining what constitutes a risk to minors. “While it is important to encourage parental involvement to ensure minor’s safety online,” Chamber of Progress argues, “parents are not always best suited to control how their child uses a platform.” As examples they note that for parents who are not supportive of their child’s identity or seek access to certain information, including health information and other online spaces that serve as a “lifeline” for the child.

Of concern are apps that provide critical services such as those supporting mental, physical and reproductive health that offer anonymity. In order for a young person to access those apps, under the current structure of the bill, their parent would be notified and would be required to give consent.

In contrast, the TransLatin Coalition, supporters of the bill, appreciate the balance struck by this bill. They write:

Many members of our community—both parents and youth—navigate multiple systems with limited resources and information. For immigrant parents, managing their children's online activities can be especially challenging due to language barriers, digital literacy gaps, and long work hours that limit oversight. The Digital Age Assurance Act offers practical solutions that support all parents, including those in our immigrant communities, by creating straightforward, accessible tools for parental oversight through the app store. It eliminates the need for parents to navigate complex settings across dozens of different platforms, provides consistent age verification standards that work across language barriers, and offers parents meaningful involvement without requiring extensive technical knowledge.

Simultaneously, this balanced approach preserves critical online resources for LGBTQ+ youth. For young people in our communities, online spaces often provide essential information and support that may be unavailable in their immediate environments. This is particularly true for trans and gender-diverse youth who may be isolated in their communities or families.

Unlike approaches in other states that effectively block access to important resources, AB 1043 acknowledges that youth need both protection and access. This balance is especially important for LGBTQ+ youth from immigrant families, who often face multiple layers of marginalization and may have fewer in-person support options.

Regarding allowing app developers and parents to determine what is and is not age appropriate content, Oakland Privacy cautions:

It is important to note for the record that there is no objective standard in the bill for what constitutes risks to minors and not only does that vary greatly from a five year old to a 17 year old, it also varies greatly from one adult perspective to another.

It seems like these decisions would be made by two entities: a) app developers who would provide some kind of censoring controls and b) parents who would operate those controls. In both cases, the vague term “age appropriate content” could mean many different things. We have seen - and this is not completely absent in the state of California - efforts to ban books from school libraries because they contain gay characters or make references to racism in society or even because they refer to sexual activity. Do we really want a version of Good Reads that censors Judy Blume’s Forever or Are You There God, It’s Me Margaret, books literally written to help young girls make sense out of puberty? Let’s not forget that although we happily play Jailhouse Rock at 10 year old slumber parties nowadays, at the time some parents wanted the song banned because Presley provoked “lewd feelings” in teenage girls. Age-appropriate is at best a highly subjective term.

6) Striking a balance between parental control and children’s privacy. In protecting children from the potential harms on the internet, like those discussed previously, there must be a careful balance between appropriate parental control and the rights of older teens to access certain platforms. At the core of this bill is a conceptually elegant solution for establishing the age of the user. By sending an age assurance signal that developers are required to rely on for having actual knowledge of the age of the user, provides a number of significant benefits:

• It alleviates concerns from privacy advocates that age verification would necessarily require everyone to provide developers and platforms with even greater sensitive personal information by having to upload official identification documents in order to prove that they are old enough to access the application or the content.
• It potentially removes the argument from the technology industry that have no definitive way of knowing the age of their users, thus allowing them to avoid responsibility for allowing children to access harmful content. As an example, applications that are restricted to adults generally simply ask the user to attest to whether or not they are old enough to access the site. With an age assurance signal, the platforms would be provided with actual knowledge of the age or age range of the user that they could then rely on to grant or deny access.
• The State’s consumer privacy law, the California Consumer Privacy Act, restricts the ability of businesses to be able to use, share, or sell personal information on minors. For those under 13, parental consent is required for the sharing or sale of a child’s information, for those older children who are at least 13, but under 16, they must consent to having their personal information shared and sold. However, those restrictions only apply if a business has actual knowledge of the person’s age. An age assurance signal sent to online businesses could provide that actual knowledge.

However, this bill juggles both technical complexity and sensitive issues around parental control and children’s privacy and autonomy, raising questions about the right solutions for younger children versus more mature teens.

The author intends to continue working with stakeholders to find the appropriate balance between protecting children from the more dangerous aspects of the internet and preserving their right to both privacy and to access information. As the author continues refining the bill, she may also wish to consider:

• Defining “device.” While there is currently no definition of device in the bill, under the definition of “covered application store” it references computers, mobile devices, or “any other general purpose computing device.” This definition could conceivably cover everything from smartphones and tablets to smart televisions, gaming consoles, fitness devices or other household items. The author may wish to more specifically delineate which devices are intended to be covered.
• Narrowing the types of applications. As the opposition noted, the current definition of “application” includes every application and computer program, including those that have no discernable harmful impact. The current definition in the bill would include functional applications such as calendars, to-do-lists, simple games, keyboards, clocks, maps, and weather apps. The author may wish to specifically define which types of applications, computer programs, and websites the bill is intended to cover.
• Allowing automatic blocking. There are a number of applications that have already been deemed inappropriate for children under a certain age. For example, Instagram, a social media platform owned by Meta, prohibits children 12 and under from having accounts. In addition, it has restricted accounts for teenagers under 16. As another example, just as with analog pornographic material, minors are prohibited from accessing pornographic websites. Similarly, many AI girlfriend applications are restricted to adults. Rather than going through the process of seeking parental consent for applications that are not appropriate for the age range of the user, and then developing parental controls, the author may wish to require that applications already determined to be inappropriate or unsafe simply be blocked for young users.
• Considering the appropriate age of consent for downloading applications. As currently drafted, parental consent is necessary in order for any young person under 16 to download and access any application, no matter how benign. In some instances, the Legislature has established 13 as the age where a young person can provide consent and do not require parental consent. For example, 13-year can decide whether or not they want to opt-in to allowing businesses to share and sell their personal information. In addition, minors 12 and older have the ability to consent to certain medical care, including testing and treatment for sexually transmitted diseases, HIV/AIDs testing, treatment and prevention, and mental health or substance use disorder treatment.^[25] Also, minors of any age can consent to reproductive healthcare, including abortion services and accessing birth control. Finally, beginning this past January, schools districts are prohibited from requiring teachers and other school employees disclose a student’s gender identity or sexual orientation to their parents. Prior to any disclosure, the child must first provide their consent. The author may wish to consider aligning the age of requiring parental consent with these other laws, perhaps setting the age at 13 to align with the California Consumer Protection Act.
• Clarifying the intentions around parental control. As currently drafted, the bill is unclear in terms of the level and types of parental control that a developer is required to include in their applications and for whom. The following language may benefit from more precision:
  • 1798.501(b)(1) requires that developers “provide readily available features for parents to support a child user’s use of the service.” Presumably this is intended to require that parents be provided with parental controls. However, it is unclear what is intended by requiring a feature that allows parents to support the user’s use of the service.
  • 1798.501(b)(1) also requires that the features allow parents to support their child’s use of an application are required to include additional features “as appropriate, given the risks that arise [from] use of the application.” (Emphasis added.)
  • 1798.501(b)(1)(A) and (C) both require features to “manage” the accounts and access. While these two sections are more easily interpreted, nonetheless, in (A) the feature must “help manage” which accounts are linked to children, raising questions about how this standard is satisfied. Along the same lines, in (C), the developer is required to include a feature that allows the parent to manage the content that is on their child’s phone. However, if the author intends for a feature that allows parents to control various features, such as the ability of the account to receive direct messages from unknown people on the platform; determining whether or not the user can access a live chat feature that allows the child to talk directly with other gamers inside an online game; or allowing the child to make in-app purchase, for example, perhaps (C) should state the parental control feature must “allow the parent to control in-app features.”

ARGUMENTS IN SUPPORT: The International Centre for Missing and Exploited Children (ICMEC), co-sponsors of the bill, write in support:

ICMEC views the device-based mechanism outlined in AB 1043 not as a solution that benefits one industry over the other, but rather as the most common sense and feasible solution. It is an industry-wide solution that holds all online services accountable in the online journey of a child.

Rather than providing personal information to dozens of websites and applications, all of which may have varying levels of security and privacy practices, the mechanism in AB 1043 centralizes the point at which age is requested at the lowest common denominator: on the device itself.

This mechanism is a technically feasible and constitutionally sound method that protects the privacy of both adult and child users. You are not disclosing the identity of a child or adult; once a user enters their age on their device, they are wrapped in a shroud of privacy that provides websites and applications only with a user’s age range. This bill will provide a critical tool to protect vulnerable children in California, children whose parents may not be involved or aware of their child’s digital experience.

The Source LGBT+ Center writes in support:

For many LGBTQ+ youth, especially those in rural or conservative areas, online platforms represent their first and sometimes only opportunity to explore their identity, find accurate information, and connect with others who share their experiences. These digital lifelines can mean the difference between isolation and belonging, between despair and hope.

Previous attempts at internet regulation have often threatened these crucial connections through overly restrictive content filters or verification requirements that compromise privacy. We have watched with concern as some legislation has created risks of censorship that disproportionately impact LGBTQ+ content and resources.

AB 1043 takes a fundamentally different approach. By focusing on age verification at the app store level rather than forcing individual platforms to implement their own systems, this legislation protects children without creating unnecessary barriers to accessing important resources.

Also writing in support, California Parents for Public Virtual Education, notes:

Today’s digital landscape was not designed with children in mind, leaving young users vulnerable to exploitation, cyberbullying, and inappropriate content. Research from the Centers for Disease Control and Prevention (CDC) highlights alarming trends, with increasing rates of depression and suicidal ideation among teenagers—particularly young girls—due to online influences.

Parents need effective tools to safeguard their children in an era where digital access is essential for education and socialization.

Assembly Bill 1043 establishes a privacy-first, uniform age verification system, ensuring that app developers and online platforms can implement appropriate safeguards. This legislation empowers parents with greater oversight and creates a responsible framework for businesses to protect young users without compromising innovation or privacy.

ARGUMENTS IN OPPOSITION: In opposition to the bill, TechNet argues:

AB 1043 requires app store providers to verify the age of users before granting access to app downloads, purchases, or usage. Age verification is a complex challenge to address and requires consideration of how to properly balance the interests of privacy and security. Stringent age verification measures could necessitate the collection, processing, and storage of sensitive personal information, such as birth dates and government-issued identification. This could conflict with data privacy principles like privacy-by-design and data minimization and create new vectors for fraud, as every user in the state must prove whether or not they are a minor.

Additionally, there are privacy concerns associated with the bill’s parental consent requirements. Parental consent entails verifying parental relationships and parental rights, which will likely lead to privacy-invasive processes beyond collecting and verifying the age of an individual. For example, even with a birth certificate, there are custody agreements and other issues that could prevent a caregiver listed on that certificate from exercising parental rights to provide consent. Additionally, the bill is silent on the specific methodologies that would be sufficient to obtain and verify parental consent as well as parental relationships and rights, leading to compliance uncertainty and potential legal vulnerabilities.

REGISTERED SUPPORT / OPPOSITION:

Support

Children Now (co-sponsor)

International Centre for Missing & Exploited Children (co-sponsor)

AAPI Equity Alliance
California Parents for Public Virtual Education
Parents for School Options
Parents Support for Online Learning
Protect Our Kids
The Source Lgbt+ Center
The Translatin@ Coalition

1 Individual

Opposition

Chamber of Progress
Oakland Privacy
Technet-technology Network

Analysis Prepared by: Julie Salley / P. & C.P. / (916) 319-2200

1. Online age verification: balancing privacy and the protection of minors (Sept 22, 2022), https://www.cnil.fr/en/online-age-verification-balancing-privacy-and-protection-minors. ↑

2. Roth, Online age verification is coming, and privacy is on the chopping block (May 15, 2023) The Verge, https://www.theverge.com/23721306/online-age-verification-privacy-laws-child-safety. ↑

3. Haidt, “The Teen Mental Illness Began Around 2012” After Babel (2023), https://www.afterbabel.com/p/the-teen-mental-illness-epidemic, summarizing Haidt et al, “Adolescent mood disorders since 2010: A collaborative review” (ongoing) available at https://docs.google.com/document/d/1diMvsMeRphUH7E6D1d_J7R6WbDdgnzFHDHPx9HXzR5o/edit?tab=t.0#. ↑

4. “The Teen Mental Illness Began Around 2012,” supra. ↑

5. Id. For older teens, the increase for girls was 48%; for boys, 37%. ↑

6. Id. For older teens, the increase for girls was 63.9%; for boys, 35%. ↑

7. A series of articles from Haidt and Rausch addresses this issue under the header “The International Mental Health Crisis” on Haidt’s Substack, After Babel, https://www.afterbabel.com/t/the-international-mental-health-crisis. ↑

8. Haidt, “End the Phone-Based Childhood Now” The Atlantic (March 13, 2024), https://www.theatlantic.com/technology/archive/2024/03/teen-childhood-smartphone-use-mental-health-effects/677722/. ↑

9. “Social Media and Youth Mental Health: The U.S. Surgeon General’s Advisory” (May 23, 2023) p. 4, https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf. (“Surgeon General’s Advisory”) ↑

10. Ibid. ↑

11. Alhajji et al., “Cyberbullying, Mental Health, and Violence in Adolescents and Associations With Sex and Race: Data From the 2015 Youth Risk Behavior Survey” Global pediatric health (2019), https://journals.sagepub.com/doi/10.1177/2333794X19868887; Vogels, “Teens and Cyberbullying,” Pew Research Center: Internet, Science & Tech (2022), https://www.pewresearch.org/internet/2022/12/15/teens-and-cyberbullying-2022/. ↑

12. Nesi, et al., “Teens and mental health: How girls really feel about social media” Common Sense Media (2023), https://www.commonsensemedia.org/research/teens-and-mental-health-how-girls-really-feel-about-social-media. ↑

13. Rideout, V., & Robb, M. B. “Social media, social life: Teens reveal their experiences” Common Sense Media (2018), https://www.commonsensemedia.org/sites/default/files/research/report/2018-social-mediasocial-life-executive-summary-web.pdf. ↑

14. Surgeon General’s Advisory, supra, at p. 10. ↑

15. Ibid. ↑

16. Arizona et al. v. Meta Platforms, Inc., supra. ↑

17. “Dr. Vivek Murthy, “Surgeon General: Why I’m Calling for a Warning Label on Social Media Platforms” New York Times (Jun. 17, 2024), https://www.nytimes.com/2024/06/17/opinion/social-media-health-warning.html. ↑

18. Ibid. ↑

19. ‘Aggression, strangulation, coercion’: The 'concerning' impact of porn on young people. SBS News, Australia, (Nov. 13, 2024) accessed at https://www.sbs.com.au/news/article/aggression-strangulation-coercion-the-concerning-impact-of-porn-on-young-people/bo3wierrq. ↑

20. Natasha Singer, “Teen Girls Confront an Epidemic of Deepfake Nudes in Schools,” New York Times (Apr. 8, 2024) accessed at https://www.nytimes.com/2024/04/08/technology/deepfake-ai-nudes-westfield-high-school.html. ↑

21. Mackenzie Tatananni, “ ‘Inappropriate images’ circulate at yet another California high school, as officials grapple with how to protect teens from AI porn created by classmates,” Daily Mail (Apr. 11, 2024) accessed at https://www.dailymail.co.uk/news/article-13295475/Inappropriate-images-California-Fairfax-High-School-AI-deepfake.html. ↑

22. Tim McNicholas, “New Jersey high school students accused of making AI-generated pornographic images of classmates,” CBS News (Nov. 2,

    2023) accessed at https://www.cbsnews.com/newyork/news/westfield-high-school-ai-pornographic-images-students/; Lauraine Langreo, “Students Are Sharing Sexually Explicit ‘Deepfakes.’ Are Schools Prepared?” Ed Week (Sept. 26, 2024) accessed at https://www.edweek.org/leadership/studentsare-sharing-sexually-explicit-deepfakes-are-schools-prepared/2024/09; Gabrielle Hunt and Daryl Higgens “AI nudes of Victorian students were allegedly shared online. How can schools and parents respond to deepfake porn?,” The Guardian (June, 12, 2024) accessed at

    https://www.theguardian.com/australia-news/article/2024/jun/12/ai-nudes-of-victorian-students-were-allegedly-shared-online-how-canschools-and-parents-respond-to-deepfake-porn. ↑

23. “Minnesota Attorney General’s Report on Emerging Technology and Its Effects on Youth Well-Being” (Feb. 2025), p. 28, https://www.ag.state.mn.us/Office/Reports/EmergingTechnology_2025.pdf. (“Minnesota Attorney General’s Report”). ↑

24. Ibid. ↑

25. California Minor Consent and Confidentiality Laws, National Center for Youth Law (Dec. 2023) https://teenhealthlaw.squarespace.com/california/#consent. ↑