Critics say the California Age-Appropriate Design Code Act, a digital privacy law for minors, could lead to invasive age verification methods like face-scanning
Context & Ripple Effects
California's Age-Appropriate Design Code began in early 2022 as a bipartisan bill explicitly modeled on the UK's age-appropriate design code, and by October critics — led by privacy and civil-liberties voices — were warning that its duty to estimate which users are minors could only be met through invasive methods like webcam face-scanning. Within two months, a tech industry group including Google and Meta sued to block the law on over-moderation grounds, making age verification the fight's central fault line.
The critics' warning has since hardened into infrastructure: AI age scanners that read facial patterns via webcam are now a real product category websites use to gate content, and California has moved the verification burden again with [[a:891266|AB 1043, signed by Newsom, requiring device makers and app stores — not websites — to verify ages]], a bill Google, Meta, and OpenAI backed.
First-order effects
- Websites and apps serving California minors face a compliance choice between estimating age from behavioral data and deploying biometric checks like the face-analysis scanners now on the market — the exact trade-off critics flagged when the bill passed.
Second-order effects
- A commercial age-verification vendor market is consolidating around webcam facial analysis, and the industry's litigation posture flipped: the same Google and Meta that backed the 2022 lawsuit against the design code supported AB 1043's app-store-level mandate, which shifts verification cost onto Apple and Google's platform businesses.
Third-order effects
- If the pattern holds, US child-safety regulation normalizes biometric identity checks as a default internet gate — with the verification point migrating from individual websites to device and app-store layers, and privacy objections losing ground to safety mandates in statehouses.
The trend: Child online-safety law is industrializing age assurance, moving from website-side estimates to biometric scanning and now to device- and app-store-level mandates set state by state.