California Age-Appropriate Design Code Act

On September 15, 2022, California Governor Newsom signed AB 2273, known as the California Age-Appropriate Design Code Act (“CADC”). The law to be codified at Cal. Civil. §§ 1798.99.28 – 1798.99.40, come into effect on July 1, 2024, but organizations that will be impacted must be compliant by that date, which includes a full privacy impact assessment.

With that date more than 18 months away, we thought presenting the legal requirements in a multiple choice format might help you remember some aspects of the law, so here are ten questions (answers below):

1. The CADC applies to businesses that offer an online service, product, or feature that children are likely to access, which includes children

a. 0 to 5 years or “reading aloud and early reading ability”;

b. 6 to 9 years or “core elementary school years”;

c. 10 to 12 years or “transition years”;

i.e. 13 to 15 years or “early teens”; and

e. 16 to 17 years old or “close to adulthood”.

f. Ages 0-12 [same as COPPA]

G. Age 0-17

2. An online service, product, or feature that is “likely to be accessed by children” includes an online service, product, or feature that (select all that applies):

a. Includes advertising aimed at children

b. Contains design elements known to be of interest to children including but not limited to games, cartoons, music and celebrities appealing to children

Also Read :  Handel Architects Designs Third Tallest Tower in Historical Downtown Los Angeles

c. Determined, based on competent and reliable evidence of audience composition, to be routinely accessed by a significant number of children.

i.e. Based on internal company research, it is determined that a significant portion of the intended audience for the online service, product, or feature is children.

3. The CADC requires that the biennial data protection impact assessment includes (select all that apply):

a. Whether algorithms used by online products, services or features could harm children

b. Whether, how and for what purpose the online product, service or feature collects or processes sensitive personal information from children

c. Whether targeted advertising systems used by online products, services or features could harm children

4. Each completed privacy impact assessment must be made available to the California Attorney General upon request within ____ days:

a. Three

b. Five

c. Ten

i.e. Thirty

5. Each completed privacy impact assessment that a company submits to the California Attorney General (select one):

a. Is exempt from disclosure

b. Does not waive any applicable attorney-client privilege or attorney’s work product

c. Both a and B

i.e. Neither a nor B

6. Company must configure all child privacy settings by default (choose one):

a. At the highest level

b. The level that the company can show is most often chosen by the parents

c. At the same level made available to all users

7. The CADC prohibits a company from doing any of the following (select all that apply):

Also Read :  Opinion: Why Australia's Isaac Humphries is ready to tell the world he is gay

a. Do not collect, sell, share, or store any personally identifiable information that is not necessary to provide an online service, product, or feature that is actively and consciously engaged by a child

b. Collect, sell or share children’s accurate geolocation information by default

c. “Profile” a child

i.e. Use any Personal Information collected to estimate age or age range for any other purpose, or retain such Personal Information longer than is necessary for the age estimation

8. If the company is in substantial compliance with the requirements of the CADC, the CADC provides that the Attorney General must provide notification and an opportunity to correct any identified deficiencies within the following time limits:

a. 30 days [same as CCPA—through December 31, 2022 only]

b. 45 days

c. 60 days

i.e. 90 days

9. The CADC does not have the right of private prosecution, but the Attorney General may seek civil penalties of $2,500 for negligent violations and $7,500 for intentional violations, with violations calculated per

a. child

b. Day

c. Subsection of the CADC violated

10. What technical tools are available to me to: (1) help me understand my risk profile and take steps to comply with the CADC; (2) create actionable reports to determine how my consumer-facing assets collect and share data, including personal information; and (3) assist in conducting the necessary systematic survey to assess and mitigate risks arising from the Company’s data management practices for children who have a high likelihood of accessing the online service, product, or feature?

Also Read :  Judge delays Twitter trial, gives Musk time to seal buyout

a. I can do this manually

b. Nothing exists, but it would be great if it did

c. NT analyzer


The CADC contains many more provisions, but as you can see, the detailed privacy impact assessment has to be ready shortly after July 1st, 2024. Affected companies that are already planning for the new privacy laws coming into effect next year (California, Colorado, Connecticut, Utah, and Virginia) may want to add the CADC now, as the information will likely be relevant to other compliance efforts.

If you would like to discuss your privacy concerns or see how NT Analyzer could specifically help you, please let us know and we’d be happy to set up a demo. Visit our website to learn more:


1.g (0-17)

2 a, b, c and d – all

3. a, b and c – all

4. b (five days – there are 3 days to inform the client of the number of reviews on request)

5. c (both are exempt from publication and do not waive privileges)

6. a (highest level)

7. a, b, c and d – all

8th d (90 days)

9. b (per child)

10. c (NTA analyzer)

Source link